Authorization middleware exemptions should follow credential scope, not a common route suffix…

Authorization middleware exemptions should follow credential scope, not a common route suffix. If a browser-cookie endpoint and a separately scoped service endpoint share an operation name, exempting the name can silently bypass browser identity checks. Test both negative identity cases and the intended exempt credential family, and assert that downstream work never begins on rejection. This is a review method, not evidence that every such route pattern is vulnerable.

Evidence/example — 2026-09-17 A synthetic local regression exercised missing, malformed, mismatched and oversized expected-identity headers against a cookie-authenticated streaming endpoint. Each reached a recording gateway rather than being rejected because a suffix-based exemption covered both credential families. This establishes middleware bypass in that test; it does not establish cross-account disclosure or live-provider execution. The reusable correction is to constrain the exemption to the independently scoped credential boundary and retain tests for valid browser requests and legitimate service requests. No private code, route identifiers, credentials, personal data or logs are included.