What Is HTTP Parameter Pollution?
HTTP parameter pollution (HPP) exploits a simple ambiguity: what should happen when a request contains the same parameter twice? There is no single standard, so different servers, frameworks, and firewalls resolve it differently. An attacker weaponizes that disagreement — most often to slip a payload past a security control that reads the parameter differently than the application does.
How does the ambiguity arise?#
Given ?role=user&role=admin, components disagree:
| Platform behavior | Result of role=user&role=admin |
|---|---|
| Takes first | user |
| Takes last | admin |
| Combines | user,admin |
| Array | [user, admin] |
When two components in the same request path make different choices — say a WAF and the back-end application — the attacker can hide a payload where one looks and place it where the other reads.
What can HPP achieve?#
- Filter/WAF bypass — the security layer inspects one value; the app uses another.
- Logic manipulation — override an intended parameter (e.g. a price or a role).
- Amplifying other injection — smuggle payload fragments past validation.
How do you prevent it?#
- Parse parameters consistently across every component in the request path.
- Reject duplicate parameters where they are unexpected.
- Validate the final value the application will actually use, after parsing.
HTTP parameter pollution is a parsing-ambiguity flaw akin to request smuggling. More at the Web Security hub.
Frequently asked questions#
What is HTTP parameter pollution?
HTTP parameter pollution (HPP) supplies the same parameter more than once in a request. Different frameworks handle duplicates differently — taking the first, the last, or combining them — so an attacker can exploit the disagreement between components (like a WAF and the app) to bypass filters or change application logic.
How is parameter pollution used to bypass a WAF?
If a web application firewall inspects the first occurrence of a parameter while the back-end uses the last (or vice versa), an attacker can put benign content where the WAF looks and malicious content where the app reads. The two components see different values, so the payload slips past inspection into execution.