@davepYeah, my understanding is that if something is in the middle, then unless there's something like WebAuthn (or some other equivalent steps) that enforces binding -- cryptographic validation -- of the actual origin at the far end ... spoofing is possible.@atoponce