title: NodeJS express: limiting access to route
body: <p>I'm creating an <em>express</em> project and I have some routes to provide data to frontend controllers via ajax, for instance they begin with <code>/get_data</code>.</p>
  
  <p>So my question is how to protect these routes? Anyone can access them easily. I tried to do</p>
  
  <pre><code>app.use((req, res, next) =&gt; {
      if(!req.xhr) res.sendStatus(404);
      else next();
  })
  </code></pre>
  
  <p>But this doesn't prevent ajax calls from other sites to access the data. So how to make it more secure? If it's not possible, in what way can I provide data to frontend?</p>