Exercise screenshots

These examples show what to look for. Use your own run as submission evidence.

Starting point

Starter returns another student’s record with HTTP 200.

Expected result

Repaired app denies that same request with HTTP 403 and does not disclose the record.

Source

Captured from the supplied student and solution apps using tooling/access-browser-smoke.mjs. Records and identities are fictional; both requests target record 102.