So I have added some swagger configuration in a routes folder like so:

import express from 'express';
import swaggerUi from 'swagger-ui-express';
import swaggerDocument from '../swagger/swagger.json';
const router = express.Router();

router.get('/api-docs', swaggerUi.setup(swaggerDocument));

export { router as swaggerRouter }

Now there is an authentication process in the root app.ts file, but my understanding is if I add the swagger endpoint before it executes the authenticate logic, it should not ask for headers:

app.get('/', (req, res) => {
  res.send('Howdy!');
});

app.use(swaggerRouter);

app.use(async (req, res, next) => {
  const result = await auth.verifyAuth(req).catch((err) => {
  return err;
  });
  if (result.httpCode == 200) {
    res.locals.authResult = result
    next()
  } else {
    res.send(result)
  }
});

So the authentication logic from where verifyAuth comes from would make for a good middleware to target endpoints instead of the whole entire application, but to refactor it to work as such a middleware is a pain because the author wrote every function to depend on every other function.

And yet, if I add a random endpoint above that authenticate logic like:

router.get('/pingMe', (req, res) => {}

You can go to that one without being asked to provide headers.

What am I missing?

I literally removed the authentication logic and I am still unable to get to the swagger endpoint without being asked for headers.