Authorization disclaimer. This walkthrough applies only to the intentionally vulnerable PortSwigger Web Security Academy lab linked below. Test workflow manipulation only on systems you own or are explicitly authorized to assess.

Overview

This lab demonstrates an authentication state machine that assumes every user will complete its transitions in the intended order. Login includes a role-selection step, but if its request is dropped, the server retains an unsafe default state and the resulting session receives administrative access.

Lab overview diagrams `POST /login/role-selector` as the login state-machine transition that can be skipped.
Lab overview diagrams `POST /login/role-selector` as the login state-machine transition that can be skipped.

Lab objective/setup

The objective is to sign in with the supplied account, reach the administrative panel, and delete carlos. Burp Suite is used to observe the multi-step login flow and interrupt the request to POST /login/role-selector.

What I observed

After the username and password stages, the application displayed an unusual page requiring a choice between the user and admin roles.

Post-login page presents the unusual role selector after valid username and password authentication.
Post-login page presents the unusual role selector after valid username and password authentication.

The page offered both role values directly, making the transition worth examining while Burp interception was enabled.

Role selector exposes both `user` and `admin` choices before the session state is finalized.
Role selector exposes both `user` and `admin` choices before the session state is finalized.

Why it is vulnerable

The server treats the expected browser sequence as though it were guaranteed. In this lab session, dropping the role-selection transition left the resulting session with administrative access. This is consistent with unsafe retained or default state, but the browser-side evidence does not establish the backend’s exact initialization logic. The demonstrated failure is that an incomplete workflow is accepted without a fresh authorization decision.

Walkthrough in the authorized PortSwigger lab

  1. Enable Burp interception and log in with the credentials supplied by the Academy.
  2. Forward the login requests until Burp captures POST /login/role-selector.
  3. Drop that request instead of forwarding a selected role.
Burp Proxy intercepts `POST /login/role-selector`, the request that is dropped instead of submitting a role.
Burp Proxy intercepts `POST /login/role-selector`, the request that is dropped instead of submitting a role.
  1. Return to the site. The session now exposes the administrative panel despite the role-selection step never completing.
Reloaded application exposes the admin panel because the skipped transition leaves the session in its default admin state.
Reloaded application exposes the admin panel because the skipped transition leaves the session in its default admin state.
  1. Use the panel’s delete action for the synthetic user carlos.

Verification

The Academy displayed its solved state after Carlos was deleted. The critical evidence is that omitting one expected request did not invalidate the login; instead, the resulting session retained administrative privileges.

Admin panel deletion of `carlos` produces the Academy solved response.
Admin panel deletion of `carlos` produces the Academy solved response.

Impact and defensive lesson

Model authentication as an explicit server-side state machine with deny-by-default initialization. Every protected action should require a completed, valid state and an independently verified authorization decision. Missing, repeated, reordered, or expired transitions must invalidate the workflow rather than preserve a privileged default. Avoid assigning sensitive roles before validation is complete, and test abnormal navigation paths as carefully as the intended sequence.

References

Migration provenance

This article preserves the reasoning and six screenshots from the authorized lab session. The prose, organization, captions, and accessibility text were normalized without adding observations.