The app reads the last occurrence of a repeated parameter. A front-end check that reads the first sees role=user; the backend sees the last. Try /hpp?role=user&role=admin.
CWAP Prep Labs · HackXpert Coaching · The XSS Rat · authorized lab use only