> used a secret token for auth instead of a signed
Seems that you'd still have an issue here, as the secret token would still be linked to a user ID somewhere in the system.
Seems that you'd still have an issue here, as the secret token would still be linked to a user ID somewhere in the system.
Because they used a signed user ID, there was no way to differentiate the user 123 from before the system restore and after.