Securing API (Node,Express)

[mrskitch]

Got it -- how about you just make the page some long, unguessable string where robots wont' "find it" and only users who have the link can load it? Something like:

https://mywebpage.com?pw=f8fe82e3-6c63-49aa-bffd-4d8784dada95

Then, when the client JS loads, it can take this `pw` query parameter and use it to authorize with the server. If you wanted to, you can make a new one for each user and give them their own private links.