HTTP Parameter Pollution (HPP): How to Find Logic Bugs
HTTP parameter pollution happens when a request contains duplicate parameter names and front-end, middleware, and backend disagree on which value wins. One layer may see id=1 while another sees id=2, or an array [1,2].
That disagreement creates authorization gaps, WAF bypasses, and odd business logic.
Why frameworks disagree
- Some take the first value, some the last
- Some concatenate into arrays
- Query string vs JSON body vs multipart may be parsed differently
- WAFs may inspect a different view than the app
Your job is to send duplicates and observe which component reacted.
High-yield tests
- Replay a sensitive request with
id=YOUR_ID&id=OTHER_TEST_ID(both accounts you own). - Try
role=user&role=adminon profile update endpoints. - Mix sources: query + body with the same name.
- Encode differently:
id=1&id=1%0dor array formsid[]=1&id[]=2.
Watch for: different object returned, different auth decision, WAF allow vs app deny (or the reverse).
Proving impact
Use two test accounts. Show the exact duplicated parameter, which value each layer honored, and the security decision that flipped (access to the other account’s object, price change, role flag).
Never pollute parameters to reach real customer data.
Common false positives
- App rejects duplicates entirely
- Both values ignored in favor of path ID
- Harmless reflection with no authorization change
Report structure
Document parser behavior (“backend used last value, gateway used first”), the request, and the resulting privilege or logic break. Suggest normalizing inputs once at the edge and rejecting ambiguous duplicates.
Defensive checklist
- Parse parameters once and pass a typed object downstream.
- Reject requests with duplicate keys on security-sensitive fields.
- Align WAF and app parsers in staging tests.
- Prefer path IDs over query IDs for object access.
HPP is a parser-discrepancy bug. When layers disagree, authorization is usually next to fail.
Original Bugflare guide informed by OWASP HTTP Parameter Pollution testing guidance.