title: Node/Express - IP Restrict Access to Routes But Not Static Files
body: <p>In my MEAN app, i have an API and static web files e.g. <code>index.html</code> and <code>login.html</code>.</p>
  
  <pre><code>//Routes
  app.use('/mysuperapi', require('./routes/api'));
  
  //For static files
  app.use(express.static('site'));
  </code></pre>
  
  <p>If I didn't want users to be able to go URLs such as <code>mysite.com/mysuperapi</code> freely - i'm wondering is this is possible if at all? </p>
  
  <p>Pages such <code>login.html</code> that call an authenticate route in the API would happen from the user's machine, so I can't exactly whitelist all IPs expect my servers.</p>
  
  <p>Or are all APIs simply public?</p>
  
  <p>Any advice appreciated.</p>
  
  <p>Thanks.</p>