diff --git a/http/http_connection.hpp b/http/http_connection.hpp
index 3720d9d..8e53afa 100644
--- a/http/http_connection.hpp
+++ b/http/http_connection.hpp
@@ -361,6 +361,18 @@
             completeRequest();
             return;
         }
+
+        if (!crow::authorization::isOnWhitelist(req->url, req->method()) &&
+            thisReq.session == nullptr)
+        {
+            BMCWEB_LOG_WARNING << "[AuthMiddleware] authorization failed";
+            forward_unauthorized::sendUnauthorized(
+                req->url, req->getHeaderValue("User-Agent"),
+                req->getHeaderValue("Accept"), res);
+            completeRequest();
+            return;
+        }
+
         res.setCompleteRequestHandler([self(shared_from_this())] {
             boost::asio::post(self->adaptor.get_executor(),
                               [self] { self->completeRequest(); });
@@ -574,8 +586,7 @@
                 }
                 sessionIsFromTransport = false;
                 userSession = crow::authorization::authenticate(
-                    req->url, ip, res, method, parser->get().base(),
-                    userSession);
+                    ip, res, method, parser->get().base(), userSession);
                 bool loggedIn = userSession != nullptr;
                 if (loggedIn)
                 {
@@ -713,7 +724,8 @@
                     userSession = nullptr;
                 }
 
-                req.emplace(parser->release());
+                // Destroy the Request via the std::optional
+                req.reset();
                 doReadHeaders();
             });
     }
diff --git a/include/authorization.hpp b/include/authorization.hpp
index 7caa09a..04e0223 100644
--- a/include/authorization.hpp
+++ b/include/authorization.hpp
@@ -256,16 +256,12 @@
 }
 
 static std::shared_ptr<persistent_data::UserSession> authenticate(
-    std::string_view url, boost::asio::ip::address& ipAddress [[maybe_unused]],
-    Response& res, boost::beast::http::verb method,
+    boost::asio::ip::address& ipAddress [[maybe_unused]], Response& res,
+    boost::beast::http::verb method,
     const boost::beast::http::header<true>& reqHeader,
     [[maybe_unused]] const std::shared_ptr<persistent_data::UserSession>&
         session)
 {
-    if (isOnWhitelist(url, method))
-    {
-        return nullptr;
-    }
     const persistent_data::AuthConfigMethods& authMethodsConfig =
         persistent_data::SessionStore::getInstance().getAuthMethodsConfig();
 
@@ -308,10 +304,6 @@
         return sessionOut;
     }
 
-    BMCWEB_LOG_WARNING << "[AuthMiddleware] authorization failed";
-    forward_unauthorized::sendUnauthorized(url, reqHeader["User-Agent"],
-                                           reqHeader["accept"], res);
-    res.end();
     return nullptr;
 }