Most web frameworks accept the same query parameter more than once. The behaviour under a duplicate — which value wins, whether both are exposed, whether an array is produced silently — is not standardized and varies across the stack (proxy, framework, ORM).
The immediate consequence is that authorization checks and cache-key derivation can disagree on the “same” request. A middleware that reads the first value may authorize a request that the handler then services against the second. Cache keys computed against the first value may collide with responses generated for the second.
The practical guidance we ship on engagements is: normalize duplicates at the edge, log any request where a security-sensitive parameter appears more than once, and treat any downstream “last wins” assumption as a bug worth fixing.