• JakenVeina@lemm.ee
    9·
    2 年前

    it makes them completely inaccessible to client side JavaScript

    Dude literally said to do this for browser clients, and only support bearer tokens for non browser clients.