I worked at a very well known news company. Their auth proxy layer was set to “fail open” for a period of time if there was any issue detected in the auth backe

I worked at a very well known news company. Their auth proxy layer was set to “fail open” for a period of time if there was any issue detected in the auth backend (i.e. just return ok and a new cookie for 30 seconds). When I checked the logs that system was in a fail-open state over 50% of the time.