WAFs cannot detect parameters filled with opaque data such as base64. Consequently, We've tuned our WAF to be more strong checking these inputs.

Note : in order to find login endpoint, do not use brute-force,or guessing, they won't work.

Hint : base64(jsonobject)