diff --git a/services/web/app/src/router.js b/services/web/app/src/router.js
index 8abe75a243..72bfb4bf9a 100644
--- a/services/web/app/src/router.js
+++ b/services/web/app/src/router.js
@@ -691,6 +691,7 @@ function initialize(webRouter, privateApiRouter, publicApiRouter) {
   )
   webRouter.get(
     '/project/download/zip',
+    AuthenticationController.requireLogin(),
     RateLimiterMiddleware.rateLimit({
       endpointName: 'multiple-projects-zip-download',
       maxRequests: 10,