• JakenVeina@lemm.ee
    10·
    11 months ago

    it makes them completely inaccessible to client side JavaScript

    Dude literally said to do this for browser clients, and only support bearer tokens for non browser clients.