@jik@federate.social @rk@mastodon.well.com I’ve seen this in various forms quite often. If you use a proxy tool like burpsuite you can usually step by step walk an app loading and see some wild stuff or just bypass it altogether. (Looking at you ArcGIS) But it usually some backwards flow of how auth is handled, where they SHOULD check first before loading and not checking midway or after loading a page or api.