Route pointing to self can be bypassed by direct controller access

[emreavsar]

Imagine your gateway has also a @RestController and serves GET /user

At the same time you have a route, which will check the request with some predicates (this could be for auth) on GET /some-prefix/user

Is there a smart way to 'disable' the controller for unwanted access?

I guess that's just not possible without splitting the rest controller functionality into another service and point to it.