Not sure about the "fix", since now users can't persist a logged in browser session?
If you aren't using cookies for API auth, is there not some way to configure your server framework to just ignore them if received?
If you aren't using cookies for API auth, is there not some way to configure your server framework to just ignore them if received?
We are using cookies, as the post says, as a fallback authentication so devs can browse the API from a browser if they're logged in to the site.