title: Node.js and Angular routing - How to make REST API inaccessible by browser URL
body: <p>I use Angulars <code>$http</code> service to call for data on the backend. Let's say JSON data. An example URL to do so would be something like:</p>
  
  <pre><code>/get/data
  </code></pre>
  
  <p>Doing this from within Angular nicely returns the requested data. No problem.</p>
  
  <p>But even though I catch <strong>all other</strong> Angular routes using Angular UI Router with <code>$urlRouterProvider.otherwise('/');</code>, I can still go to my browser and type in the <code>mydomain.com/get/data</code> URL, which provides me with a page of JSON code.</p>
  
  <p>How to I restrict back-end server calls to come just from Angular, NOT from my browser URL without user authentication?</p>
  
  <p><strong>N.B.</strong>
  Using Express 4.X on Node, I also provided my app with a 'catch-all' route to default back to my front-end index.html page, like so:</p>
  
  <pre><code>router.get('*', function(req, res) {
      res.sendFile(path.join(__dirname, '/index.html'));
  });
  </code></pre>
  
  <p>Thanks!</p>