All API endpoints require authentication

Unauthenticated API endpoints are the most direct path to a data breach. OWASP API Security Top 10 2023 API2 (Broken Authentication) consistently ranks auth bypass as a top attack vector — attackers scan for unprotected routes before attempting anything sophisticated. A single unguarded endpoint returning user records, order history, or internal configuration can expose thousands of records. Beyond data exposure, CWE-306 (Missing Authentication for Critical Function) is cited in breach post-mortems from healthcare to fintech: regulators treat unprotected endpoints as a compliance failure, not just a technical one.

Wrap every route handler in authentication middleware so unauthenticated requests are rejected at the boundary before any business logic runs. In src/middleware.ts or equivalent, apply auth globally and then explicitly opt-out for intentionally public endpoints.

// src/lib/auth.ts
export function requireAuth(handler: AuthedHandler) {
  return async (req: NextApiRequest, res: NextApiResponse) => {
    const token = req.cookies.token ?? req.headers.authorization?.replace('Bearer ', '')
    if (!token) return res.status(401).json({ error: 'Unauthorized' })
    try {
      req.user = jwt.verify(token, process.env.JWT_SECRET!) as JWTPayload
      return handler(req, res, req.user)
    } catch {
      return res.status(401).json({ error: 'Invalid token' })
    }
  }
}

Document any genuinely public endpoints with a // PUBLIC comment and a corresponding entry in your API schema.