HTTP parameter pollution

When it applies

A request passes through more than one component that parses parameters — a WAF/gateway, then the app; or a frontend that builds a backend request. If they resolve a duplicated parameter differently, you can show one value to the guard and another to the logic.

Why it works

There is no single rule for ?x=a&x=b: PHP/Apache take the last, ASP/IIS concatenates (a,b), classic JSP takes the first, Node/Express makes an array. When the validator and the consumer sit on different stacks, a value that passes validation isn't the value that's used.