beginnerAuthentication

Lock Down an Endpoint

Decide what you would build from the brief alone. Everything below it is available, but the exercise stops working if you open it first.

The brief you were given

GET /me should return the current user's profile. Anonymous callers get 401. Add authentication to the route.

The trap — the wrong fix that looks right

Adding the authentication middleware globally and considering the job done. Global middleware is the right shape, and it makes the *exceptions* the dangerous part: the health check, the webhook receiver and the public docs route all have to be excluded, and each exclusion is a route that now has no authentication. Exclusion lists drift silently — a route added later inherits whatever the list said last year. Enumerate what is public and assert it in a test, rather than trusting the negative.