Associating an identity with HTTP requests – a Burp extension

This document introduces a Burp Suite extension called Identity (BurpId) that lets analysts map web requests to specific users by defining rules for login/logout detection and session cookies, then pivot those requests across parameters and users to assess access-control behavior. It supports creating rules to identify successful vs. failed actions, links repeated sessions to identities, and previews planned features like automated session token substitution and status-driven visualizations to accelerate access-control testing.