Hi @Nishant-Dwivedi , thanks for suggesting. I think the current logic is correct though — the ! is intentional because we want to block requests that are missing the x-auth header.

Also, we use next('router') to skip the rest of the router if the header is missing, so it falls through to the 401 handler.

I think we need to improve our documentation on next().
Cc @expressjs/docs-wg