You can put your auth logic in a plug and route the requests that need to be authenticated via it.

One way to do it is by adding an extra “authenticated” router plug.

defmodule YourApp.MainRouter do
  use Plug.Router
  
  plug :match
  # ...
  plug :dispatch

  get "/" do
    send_resp(conn, 200, "all unauthenticated requests can be handled in this router")
  end

  forward "/users", to: YourApp.AuthedRouter
end

defmodule YourApp.AuthedRouter do
  use Plug.Router

  plug :match
  plug YourApp.AuthPlug
  plug :dispatch

  get "/:user_id/favorites" do
    body = get_favorites(user_id)
    send_resp(conn, 200, body)
  end
end

But if you don’t have many routes that need to be authenticated, you can put the “whether to authenticate?” logic into the authenticating plug itself.

defmodule YourApp.AuthPlug
  @behaviour Plug

  def init(opts), do: opts # maybe list the routes that need to be authenticated in opts

  def call(%{path_info: ["users" | _rest]}, _opts) do
    # authenticate
  end

  def call(conn, _opts) do
    # don't authenticate
    conn
  end
end