Bypassing client-side controls
With all of the capabilities of modern web applications on the client side, it's sometimes easier for developers to delegate checks and controls to client code executed by the browser, thus freeing the server of that extra processing. At first, this may seem like a good idea; that is, letting the client handle all of the data presentation, validation of user input, and formatting and use the server only to process business logic. However, when the client is a web browser, which is a multipurpose tool that is not used exclusively for one application, and which can use a proxy to tunnel all communications that can then be tampered with and controlled by the user, developers need to reinforce all security-related tasks such as authentication, authorization, validation, and integrity checks on the server side. As a penetration tester, you will find plenty of applications that fail to do this consistently.
A very common scenario is when applications show or hide...
