In the particular case I mentioned above, it seemed the recommended avenue was to do sign in on the backend so you could mock it out.

Sounds fine on paper but in our case, we called out to multiple backends, with no unifying gateway that traffic reached them through as they were owned by different teams.

Realistically, that was a discipline issue rather than a technical issue of course but I do wonder how many organisations find tools like Cypress a non-starter due to their impure set up