We have a Web AppBuilder application that consumes services from an internal ArcGIS Server machine (inside our firewall), as well as public services we have published on ArcGIS Online. The web map is also on ArcGIS Online.
All of the ArcGIS Online services are shared with "Everyone".
We have a secure routing service tied to the "Directions" widget that is shared publicly. The shared version of the URL is added to the widget so that it does not require users to login.
This setup has worked perfectly since late March, however in the past couple of weeks we've had an issue where an ArcGIS Online login prompt will show up on screen. The user must enter ArcGIS Online credentials (if they have them), or if not, they must refresh the page and then can continue working. This is extremely annoying for the users (and for us), as it doesn't seem to happen to everyone, and it also is very random. Sometimes it shows up in 30-minutes, other times it seems to take over an hour.