title: How to protect static folder in express with passport
body: <p>I have a project based on express with a required authentication based on passport.</p>
  
  <p>The backoffice is an angularjs app served as static files.</p>
  
  <p>My authentication code is completly based on <a href="https://github.com/jaredhanson/passport-local/blob/master/examples/express3-no-connect-flash/app.js" rel="noreferrer">https://github.com/jaredhanson/passport-local/blob/master/examples/express3-no-connect-flash/app.js</a></p>
  
  <p>To do not serve the angular app if you are not authenticated. I have try by adding ensureAuthenticated on the /admin route but it make the route not working (404). Once I remove ensureAuthenticated the /admin is served.</p>
  
  <pre><code>app.use(express.static(path.join(__dirname, 'public')));
  app.use('/admin', ensureAuthenticated, express.static(path.join(__dirname, 'admin')));
  //serve routes
  app.use(app.router);
  </code></pre>
  
  <p>The public folder contains the login page.</p>
  
  <p>How could I achieve this ?</p>