Home·Guides·How a cross-user replay works
How a cross-user replay works
Routelint·
A cross-user replay keeps the URL and the body from User A and swaps only the caller. If User B receives User A’s record, the handler never checked who owns it.
You add User A, then add User B and set Peer of to User A. The suite takes a call captured as User A, such as GET /api/invoices/inv-9001, and sends it with User B’s token.
On the demo shop any signed-in caller can read any invoice id. User B’s response is the invoice that belongs to User A, with the card stored as [REDACTED_CARD].