The title should really say it all:
- Web Application with both Windows (NTLM) and FBA
- CSOM and REST requests are both failing with 403 (Forbidden)
ClientContext.AuthenticationMode set to "Default" (there is no "force windows auth" option)
SPClaimsAuthRoleProvider is the default provider in IIS
If I remove FBA then all my API calls start working. Any ideas?