Deny by default

How to do it

Apply the login check to the whole app, then list the public routes by name. A new route is then private until someone decides otherwise. Review the public list in each change.

Example

const PUBLIC_ROUTES = new Set(['/', '/login', '/healthz']);
app.use((req, res, next) => PUBLIC_ROUTES.has(req.path) || req.user ? next() : res.sendStatus(401));

# Python with Flask
PUBLIC_ROUTES = {"/", "/login", "/healthz"}

@app.before_request
def require_login():
    if request.path not in PUBLIC_ROUTES and g.user is None:
        abort(401)

How to check

List every route the server answers. Call each one without a token. Only the routes on the public list return 200.