Oauth

A gated app shows its login screen to everyone and its actual product to almost nobody. Putting a live sample on that screen took a few lines — and immediately exposed a CDN that had been failing silently for anyone whose network was not mine.

A successful Google sign-in proves someone owns a Google account — not that they may use your app. Without an allowlist the page is open to everyone, and a new OAuth client answers every sign-in with 403 until the consent screen is dealt with.