Replay, AuthZ Diff, and Race

Replay, authorization comparison, and race testing remain central to WSHawk v4.0.4. Electron + Go expands two-identity diffing into policy-aware matrices.

Replay

Replay takes a captured real action and re-sends it with stored identity context. This is usually far more defensible than inventing a synthetic payload from scratch.

Replay is useful for:

• confirming a state-changing action
• re-running browser-authenticated behavior
• reproducing a bug during analysis

AuthZ Diff

AuthZ diff compares the same action across identities and groups the differences for operator review.

This is where many serious v4 findings come from:

• cross-tenant exposure
• cross-role behavior mismatch
• hidden fields returned to the wrong user
• actions that should fail but still succeed

Authorization Matrix

Electron + Go can compare anonymous, User A, User B, and Admin against the same HTTP, GraphQL, or WebSocket operation. Explicit policies explain the expected access relationship, while semantic analysis handles application denials, GraphQL errors, partial data, volatile fields, and sensitive owner data.

Multi-object confirmation can require the same failure across at least two foreign resources before increasing finding confidence.

Race Testing

Race testing focuses on actions where timing matters:

• duplicate approvals
• stale token reuse
• replay-before-invalidation windows
• double-spend or duplicate refund style logic bugs

Why This Matters

A scanner can suggest problems. Replay, AuthZ diff, and race testing can prove them in a stateful workflow with attached evidence.