In the case of Attack scenario 2, I do not get why in a secure design you would ever forward the client originating data to the auth service. This is more of a

In the case of Attack scenario 2, I do not get why in a secure design you would ever forward the client originating data to the auth service. This is more of a broken best practise then a footgun to me. The logic should be "Parse, don't validate"[0] and after that you work on those parsed data. [0]: https://hn.algolia.com/?q=https%3A%2F%2Flexi-lambda.github.io%2Fblog%2F2019%2F11%2F05%2Fparse-don-t-validate%2F https://hn.algolia.com/?q=https%3A%2F%2Flexi-lambda.github.i...