> strange devices show up for some of our customers' users
> how did it load these pages which were often behind an authwall without ever logging in or having auth cookies?
Either
- The customer has screwed up user auth big time and some X knows that.... lets go with no
- OP's data is wrong or they are reading it wrong
- They are explaining it badly.
Either way it feels like malware on a client machine, but doesn't necessarily mean that the page contents are being read by the malware.
I guess if you had some javascript which only loaded if the chrome version was not the latest you could confirm -- the attempt to load the URL would not occur on GoodChrome, but it would on the "security" device. Therefore if the page contents was being shipped to BadDevice completely it would be loaded, but if it was just re-loading the URLs called by GoodChrome the URL wouldn't be called.