The author discovered a silent IDOR vulnerability in a financial system where the X-Account-Id request header was trusted by the backend, allowing any user ID to retrieve full transaction, rewards, and billing data without authentication, and reported it responsibly for a rapid fix and reward.
This article explains the purpose, common fields, and examples of HTTP request headers, request bodies, and response status codes, and shows how to parse and validate them in automated API testing to ensure correct and stable interfaces.
This guide explains why and how to change HTTP request headers during Selenium WebDriver automation, covering three practical approaches—using REST‑Assured, employing a BrowserMob proxy, and configuring a Firefox extension—complete with code examples and step‑by‑step instructions.
This article demonstrates how to secure microservice communication by adding a request token in Spring Cloud Gateway, implementing a global filter to validate the token, and configuring a Feign interceptor to automatically attach the required header, ensuring all services route through the gateway.
