Configuration: Client-Side State Tampering¶

Identifier: client_side_state_tampering

Scanner(s) Support¶

Description¶

Client-side state tampering occurs when applications trust user-controlled client state for security-sensitive decisions, allowing attackers to alter hidden fields, local storage, cookies, or serialized state.

How we test: We modify client-controlled state values and replay affected requests to detect when the server accepts tampered state for authorization, pricing, workflow, or other security-sensitive decisions.

Configuration¶

Example¶

Example configuration:

---
security_tests:
  client_side_state_tampering:
    skip: false

Reference¶

skip¶

Type : boolean

Skip the test if true.