It doesn't block passed requests when I have a middleware that checks whether you are authenticated.

export default defineEventHandler((event) => {
    const notRequireAuth = ["/api/public"];
    const {auth} = parseCookies(event);
    const path = event.path;

    if(startsWith(path, "/api")){
        if(isEmpty(find(notRequireAuth, (url) => path.indexOf(url) !== -1))){
            if(isNil(auth)){
                throw createError({
                    statusCode: 401,
                    statusMessage: "You aren't authenticated"
                });
            }
        }
    }
});