[hypeatei]

.NET web apps / APIs have an option where you can require authorization on all controllers (and their actions) by default. If you need an anonymous controller/action, you can use the `[AllowAnonymous]` attribute on it.

[api_or_ipa]

You can easily do the same with most (all?) routers using middleware. Whether you get it slotted in your roadmap is a different story.