javascript - Protect Directories with Login NodeJS -

(a "follow up" of nodejs session authentication)

using node, i'm using app.get(...) authenticate() http requests, works nicely, however, work-around end-user inputs url browser.

so i'm sending request app.get("/oneplayer",authenticate ... ) , if you're logged in, redirect /one-player/index.html

so put /one-player/index.html browser , suddenly, they've gotten around login check.

no big deal, can app.get("/one-player/index.html" ... )? sure.. works, means have app.get every file login protected.

how can login protect files, option exclude specific files/http requests (example: login.html , createaccount.html don't need account access)?

app.get('/oneplayer', authenticate, function(req, res) {     fs.readfile('one-player/index.html', function(err, content) {         res.render(content);     }); }); 

or similar. don't statically serve html files, serve them after checking.

ps: there no error checking, , may have specify charset of file in readfile options. not production code.