Session inspector
Your session is carried in the session cookie — a JSON Web Token. The server validates
it on every request and shows who it thinks you are. Become admin.
Your session cookie (JWT — base64url, decodable)
eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJ1c2VyIjoieW91Iiwicm9sZSI6InVzZXIifQ.0E2cqOIHUaXjHeE2uWJXJhpulH2NerwRSiNX6rfJRkM
This token is not editable here. It lives in a cookie, so changing your role means editing that cookie in the request.
Accepted. user=you, role=user
Stuck? You've missed the flag a few times. The full solution — root cause, exact payload and fix — is on the walkthrough page.
Check the solution on the walkthrough page →This is an isolated, intentionally-vulnerable sandbox. Data here is fake and scoped to you. The rest of CSPSHIVAM Playground is not part of the target.