[donmcronald]

That’s why I said I was surprised. I just can’t understand how anyone, let alone what I assume is a team, could write auth code without reading the spec to see what every parameter does. Even if you weren’t paying attention I feel like you shouldn’t miss that one, right?

Is that full stack overflow development where some one is copying and pasting things they don’t understand?

[user5994461]

The recommendation is ignoring the reality of the world. How can developers handle authentication when authentication is not allowed on their company domains?

Measures like filtering/whitelisting are always pushed back in my experience because it's legitimately preventing developers to support authentication.