Security vulnerability in profile-switching flow — intercepting and substituting a different user ID

richard32: Has anyone found a cleaner solution to this pattern that avoids returning any credential to the frontend? The backend can actually “notify” the front end of data changes via the Trigger a custom event when data changes action. You might find the technique outlined in this post to be helpful.