To confuse the attackers, some developers rewrite the URLs used in the request, or use the named magic URLs, which are URLs rewritten to be shorter and look better when you are managing long paths. However, as all the information is sent into the request, the attacker can just copy and use the same information to perform the attack.