Trust boundaries

Numeric and business parameters that cross steps: amounts, quantities, roles: must stay consistent with server-side policy.

1 min di letturaaggiornato il 2 ott 2026florianamette1 contributore
Chiedi al tuo assistente (MCP)Modifica su GitHub

Trust boundaries are the edges where data leaves one enforcement context and enters another: from browser to API, from microservice A to B, or from synchronous form to async job. The library focuses on numeric and business parameters that are easy to tamper when hidden fields or JWT claims are trusted blindly.

Pages#

PageFocus
Numeric integrityPrices, fees, tax lines, quantities
Business parametersProduct SKU, shipping tier, entitlement tier

Tools#

  • Burp Suite (Repeater): tamper numeric and business parameters as they cross steps, then replay to commit.
  • Manual testing with Burp Repeater and crafted payloads.

References#

  • PortSwigger Web Security Academy: Business logic vulnerabilities
  • OWASP WSTG: Testing for Business Logic
PrecedenteWebhook replaySuccessiva Numeric integrity