The issue has been Resolved, whilst the form is still "broken" if javascript fails, it no longer presents the same security risk. As noted by this reddit user https://www.reddit.com/r/starcitizen/comments/7t5uxm/i_was_having_issues_with_the_rsi_site_when_i/ The login form has some problems. Especially the one found at https://robertsspaceindustries.com/connect If javascript is turned off when the form is submitted it will direct the user like this https://robertsspaceindustries.com/connect?login_id=username&password=password THIS IS TERRIBLE and needs fixing. (here are a few good reasons why https://blog.httpwatch.com/2009/02/20/how-secure-are-query-strings-over-https/ ) My suggestion to Turbulent is to add the method and action to the form, so that as a fallback if javascript fails, it posts to the right place and still signs in the user. method="POST" action="/api/account/signin" and update the inputs on the form to actually reflect the expected variables passed in the ajax request. This way both methods of submitting would work safely. Then on the server, check if the request is an ajax one, if not, send back a redirect after setting your session cookies, to the 2fa page or the user page. Please upvote this for visibility. I would submit this to the issue council if it still had a segment for the website. It's also being leaked to external parties, "fortunately" this only includes google for now....