Reversing client-side request signing

When it applies

An endpoint you want to fuzz (for web-idor, api-bola, api-mass-assignment, or business logic) rejects tampered requests with a signature invalid / 401 because the client computes a guard value in JavaScript — an HMAC over the body, a nonce+timestamp, or an encrypted payload. You need to reproduce one valid signed request outside the browser so you can mutate the parts that matter and re-sign them.

Why it works

The signature is client-side integrity theater: the secret and the algorithm ship to the browser, so anything the browser can compute, you can compute. The signing weakness itself is almost always N/A — the payout is the access-control or logic bug on the endpoint it was "protecting". Reproduce the signer, and that endpoint becomes as fuzzable as an unsigned one.

Method