"Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn't check anything. They just served whatever you asked for." This was common at my previous job, so many things checked the roles in the JWT and di...

This is amazing

Major bummer they didn’t

Fack

WTF, lol. FIFA is as efficient as a government 🤣

Could’ve taken over the stream to show ANYTHING to a billion humans… What a missed opportunity 😅