# Challenge DescriptionHTTP requests and libraries are hard. Sometimes they do not behave as expected, which might lead to vulnerabilities.
# SolutionWe are given the Source Code of a web service.We have 2 python files, one for the frontent (app.py) and one for the backend (backend.py)
Looking at these lines  :app.py:```pythonr = requests.Request("GET", "http://backend:8080/whoami", cookies=cookies, headers=headers)```backend.py:```python@app.route('/whoami')```
This means that the frontend (the page we are in) sends a get request to the backend including the cookies of the page.
In backen.py we also see:```python	role = request.cookies.get('role','guest')	really = request.cookies.get('really', 'no')	if role == 'admin':		if really == 'yes':			resp = 'Admin: ' + os.environ['FLAG']		else:			resp = 'Guest: Nope'	else:		resp = 'Guest: Nope'	return Response(resp, mimetype='text/plain')
```
this means that the backends checks for the cookies named `role` and `really` and returns the flag if they have the values `admin` and `really` reppectivelly.
In our browser we open the Developer Tools and in Storage we create 2 new cookies : `role : admin` and `really : yes`. This way after reloading the page we get this:
``` textUsage: Look at the code ;-)
Overwriting cookies with default value! This must be secure!Prepared request cookies are: [('PHPSESSID', '137656440e0d78fa17a6c5cafa536c3b'), ('role', 'guest'), ('really', 'yes')]Sending request...Request cookies are: [('PHPSESSID', '137656440e0d78fa17a6c5cafa536c3b'), ('role', 'guest'), ('really', 'yes')]
Someone's drunk oO
Response is: Admin: ENO{R3Qu3sts_4r3_s0m3T1m3s_we1rd_dont_get_confused}```