Authentication Middleware Not Blocking Unauthenticated Requests

1. Middleware registered but never called due to incorrect order in middleware chain
2. Whitelist pattern matching is too broad (e.g., '/api/*' instead of '/api/public/*')
3. Auth check returning silently on error instead of rejecting the request
4. Exception handler catching auth failures and continuing instead of failing
5. CORS preflight requests (OPTIONS) being exempted, allowing attackers to probe endpoints

Ensure middleware is registered BEFORE route handlers. Use explicit whitelists for public routes only (e.g., /auth/login, /auth/register). Fail-closed: reject requests without valid tokens. Log all auth failures. Test each protected endpoint directly with curl/Postman to verify 401 responses.