"Except this was all client-side. The Angular app checked the JWT for a NO_ROLES marker and rendered the access-denied page. The backend APIs? They didn't check anything. They just served whatever you asked for." This was common at my previous job, so many things checked the roles in the JWT and didn't verify with the backend

This is amazing

Major bummer they didn’t

Fack

FIFA sucks at every level, daaaamn 😵 View quoted note →

WTF, lol. FIFA is as efficient as a government 🤣