Call same url twice with different parameter about burp-cph HOT 6 CLOSED

const express = require('express')
const app = express()
const port = 3000
const bodyParser = require('body-parser');

app.use(bodyParser.json())

app.get('/', (req, res) => res.send('Hello World!'))

app.listen(port, () => console.log(`Example app listening on port ${port}!`))

app.post('/', function (req, res) {
  res.send('Got a POST request')
})

app.post('/authenticate', function (req, res) {

  obj = JSON.stringify(req.headers)

  // authorization checking
  if (!JSON.parse(obj).authorization) {
    //  it should be generated dynamically
    res.json({
      "jwt": "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
    })
  } else{
    //  it should be generated dynamically
    jwt = "eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyfQ.SflKxwRJSMeKKF2QT4fwpMeJf36POk6yJV_adQssw5c"
    if (JSON.parse(obj).authorization === jwt) {
          
        req_body = JSON.stringify(req.body)
        req_jwt = JSON.parse(req_body)['jwt']

        if(req_jwt === jwt){
            res.json({"authenticated": "true"})
        } else{
          res.status(403).send({ error: "Invalid jwt in body." });
        }


    } else {
      res.status(403).send({ error: "Invalid jwt in header." });
    }
  }

  
})

POST /authenticate HTTP/1.1
authorization: ###
Content-Type: application/json
User-Agent: PostmanRuntime/7.17.1
Accept: */*
Cache-Control: no-cache
Postman-Token: a7718c11-e72d-47be-a1f9-3a25de807bb5
Host: 127.0.0.1:3000
Accept-Encoding: gzip, deflate
Content-Length: 58
Connection: close

{"jwt": "###", "username": "nino", "password": "password"}

{"error":"Invalid jwt in header."}

{"error":"Invalid jwt in body."}

POST /authenticate HTTP/1.1
authorization: ###
Content-Type: application/json
User-Agent: PostmanRuntime/7.17.1
Accept: */*
Cache-Control: no-cache
Postman-Token: a7718c11-e72d-47be-a1f9-3a25de807bb5
Host: 127.0.0.1:3000
Accept-Encoding: gzip, deflate
Content-Length: 58
Connection: close

{"jwt": "###", "username": "nino", "password": "password"}