Parameter Tampering

Parameter tampering targets data that the client sends but the server should not trust: query strings, POST body fields, hidden inputs, cookies, JWT claims, and HTTP headers. Common abuses include changing a price field in a checkout request, switching a user ID in a profile endpoint, flipping a role parameter, or bypassing client-side validation. The root cause is the server treating client data as authoritative instead of recomputing or validating it against authoritative state. Defences include server-side validation and authorization for every sensitive value, cryptographically signed or server-side state for prices and totals, allow-list input schemas, and Web Application Firewalls as defence in depth.