Who are you, and whose orders are you asking for?

Pick who you're logged in as, pick which user's orders to request at GET /api/users/<id>/orders, and toggle between this week's two real implementations. Watch what comes back. Nothing is sent anywhere — the two servers' logic is re-implemented here.

Authenticated as (the X-User-Id header) Request /api/users/<id>/orders

Server implementation vulnerable_api.py :8080 — no ownership check solution_api.py :8081 — checks ownership

Who are you, and whose orders are you asking for?

Response