Vulnerable Insecure Design Demo

This demo simulates a flawed approval workflow where the client can directly mark a request as approved. This represents Insecure Design — security logic should never be client-controlled.

How to test:
  1. Submit a request with the "Approved" checkbox checked.
  2. Inspect the server’s response — you’ll see it marked as approved.
  3. Open DevTools → Network  → Inspect the /api/insecure-design/vulnerable  request.
  4. Notice the payload includes approved: true  directly from the client.
  5. This bypasses any real approval process — a classic insecure design.
Never trust client-side security logic.