It's funny our team literally just last week did something like this at ___ BigCorp. We need to verify a JWT signature from a new 3rd party provider and then ap

It's funny our team literally just last week did something like this at ___ BigCorp. We need to verify a JWT signature from a new 3rd party provider and then append a secure auth token that is accepted by the backend service. Couldn't this just be done in the backend service? Why yes it definitely could. But apparently there are rigid security policies in place, and this stuff appears to have been carved in stone and approved by SOC2 auditors and lawyers and regulators or whatever and they have agreed that the backend gateway would use X specific formats for authentication and nobody can make any exceptions. So instead our team is spinning up an ad-hoc lambda function attached to cloudfront which will use none of our usual tooling & frameworks and have zero visibility for our security teams and be full of whatever soon to be out of date 3rd party js dependencies we need, all in the name of security so that we can pretend that the API we're communicating with is using our approved auth token format when they aren't. Just another day at a big company, really.