Working: HTTP parameter pollution attacks APIs because WAFs evaluate one parameter value while frameworks execute a different one

HTTP Parameter Pollution in APIs: the WAF evaluates one value, your framework executes another Your WAF flagged role=admin and blocked the request. Meanwhile, your Spring Boot controller processed role=user&role=admin and called getParameter("role"), which returns the first value: user. The WAF evaluated the second. The request went through....