Problem with nodejs static route and files

Question

In my project I have a report hat is reachable with index.html But this is private and I want to protect / limit access with my node app. for this I use

app.use('/allure', express.static(path.join(__alluredir , 'allure-report/')));

Then I use for bugging purpose

app.all('/allure/*', function(req, res, next) {

console.log("catched allure query");
next(); // allow the next route to run

});

But the index.html is still reachable with localhost:8080/allure/index.hmtl and also just with localhost:8080/allure/ without an console output. This confuse a lot. Anybody has an idea how to hinder access the index.html without logged in? (Is use passport)

my whole app.js file is:

const express = require('express');
const app = express();
var http = require('http').Server(app);
var io = require('socket.io')(http);
const expressLayouts = require('express-ejs-layouts');
const mongoose = require('mongoose');
const passport = require('passport');
const flash = require('connect-flash');
const session = require('express-session');
var bodyParser = require('body-parser');
const fs = require('fs');
const path = require('path');
var favicon = require('serve-favicon')
const { allureGenerator } = require('./ops/copyalluredata');

app.set('socketio', io);
//app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json({ type: 'application/json' }));
app.use(bodyParser.urlencoded({
    parameterLimit: 100000,
    limit: '50mb',
    extended: true
}));


var appDir = path.dirname(require.main.filename);
global.__basedir = appDir;
global.__alluredir = process.env.REPORT_DIR_ENV;

fs.readFile(path.join(appDir, '/config.xml'), (err, data) => {
    if (err) throw err;
    myConfigData = JSON.parse(data);

    process.env.BROWSERSTACK_USERNAME = myConfigData.browserstackid;
    process.env.BROWSERSTACK_ACCESS_KEY = myConfigData.browserstackkey;
    process.env.BROWSERSTACK_DISPLAY_RESOLUTION="1600x1200";

    console.log('config gelesen');

});

//Diese Funktion schreibt die benötigten Dateien in den allure Modul Ordner damit das Logo verwendet wird.
allureGenerator();

// Passport Config
require(path.join(appDir, '/config/passport'))(passport);
// DB Config
var db = '';
if (process.env.NODE_ENV == 'home') {
    db = require(path.join(appDir, '/config/keys')).mongoURI;
    console.log('keys');
}else{
    db = require(path.join(appDir, '/config/keys_local')).mongoURI;
    console.log('keys_local');
}

// Connect to MongoDB
mongoose
    .connect(
        db,
        { useNewUrlParser: true }
    )
    .then(() => console.log('MongoDB Connected'))
    .catch(err => console.log(err));


app.use('/allure', express.static(path.join(__alluredir , 'allure-report/')));
app.use(express.static(appDir));

// EJS
app.use(expressLayouts);
app.set('view engine', 'ejs');
app.set('views', path.join(appDir, '/views'));


app.use(
    session({
        secret: 'secret',
        resave: true,
        saveUninitialized: true
    })
);

app.use(favicon(path.join(__dirname, 'css', 'fvicon.ico')))

app.use(passport.initialize());
app.use(passport.session());

// Connect flash
app.use(flash());


// Global variables
app.use(function(req, res, next) {
    res.locals.success_msg = req.flash('success_msg');
    res.locals.error_msg = req.flash('error_msg');
    res.locals.error = req.flash('error');
    next();
});

// Routes
app.use('/', require('./routes/index.js'));
app.use('/users', require('./routes/users.js'));
app.use('/cases', require('./routes/cases.js'));
app.use('/tcafe', require('./routes/tcafe.js'));
app.use('/imgtest', require('./routes/imgtest.js'));
app.use('/rapitest', require('./routes/restapitest.js'));



io.on('connection', function(socket){
    console.log('a user connected');
});

app.all('/allure/*', function(req, res, next) {

console.log("catched allure query");
next(); // allow the next route to run

});

app.use((req, res, next) => {
    next({
        status: 404,
        message: 'Not Found',
    });
});

app.use((err, req, res, next) => {
    if (err.status === 404) {
        return res.status(400).render('404',{ layout: 'system.ejs' });
    }

    if (err.status === 500) {
        return res.status(500).render('500');
    }

    next();
});


const PORT = process.env.PORT || 8080;

http.listen(PORT, console.log(`Server started on port ${PORT}`));

Answer 1

You can use something like this Or just use somemiddleware-

app.use('/allure', function(req,res,next){
   if(<authenticate check>){ // some kind of authenticate check
     return express.static(path.join(__dirname, 'allure'));
   } else {
      <Any error you want to show>
   }
});

OR

app.use('/allure',<Auth Middlewarae> , express.static(path.join(__dirname, 'allure')));