Hiding Webservices to a layman User in NodeJS - node.js

Question

I have a PEAN (Postgre, Express, Angular, NodeJS) Stack Application. The web services are written using
Node and Express
Consumed in AngularJS service.js using factory methods.
Now For eg,When I hit the URL deployed on Heroku account like xyz.herokuapp.com/getXYZ then I can actually see all the JSON data on the Browser.
Is their anyway I can put a layer between what a layman hits an URL and what data is served to him, or is it the way it has to work.
Appreciate all the responses. I've checked with OAuth npm package but it provides the basic session management facilities, Is there anything specific that can serve my purpose?

Answer 1

I'm trying to implement something similar,
you can use passport local strategy with JSON Web Token
/login/ is supplied with username and password, if both correct it will send JWT
then you send the token received with each request to a protected router
sample code:
var pg = require('pg');
var express = require('express');
var bodyParser = require('body-parser');
var passport = require('passport');
var jwt = require('jsonwebtoken');
var jwtcheck = require('express-jwt');
var LocalStrategy = require('passport-local').Strategy;
var app = express();
app.use(bodyParser.urlencoded({ extended: true }));
app.use(bodyParser.json());
app.use(passport.initialize());
app.use(express.static(__dirname + '/client'));
secret = 'aMdoeb5ed87zarRdkD6greDZL81DcnrzeSD648ferFejmplx';
var port = process.env.PORT || 8080; // set our port
var User = [
{ id: 1, Username: 'bob', password: 'secret', email: 'bob#example.com',apikey: 'bob' }
, { id: 2, Username: 'joe', password: 'birthday', email: 'joe#example.com',apikey: 'gfsdgsfgsfg' }
];
function findByApiKey(apikey, fn) {
for (var i = 0, len = User.length; i < len; i++) {
var user = User[i];
if (user.apikey === apikey) {
return fn(null, user);
}
}
return fn(null, null);
}
passport.use('login', new LocalStrategy(
function(username, password, done) {
findByApiKey(username, function (err, user) {
if (err) { return done(err); }
if (!user) {
return done(null, false, { message: 'Incorrect username.' });
}
return done(null, user);
});
}
));
app.post('/login', function(req, res, next) {
passport.authenticate('login', function(err, user, info) {
if (err) { return next(err) }
if (!user) {
return res.json(401, { error: 'message' });
}
var token = jwt.sign({ username: 'somedata'}, secret, { expiresInMinutes: 2 });
res.json({ token : token });
})(req, res, next);
});
app.get('/db/:db/schema/:schema/relation/:relation/:id',
jwtcheck({secret: secret}),
function(req, res) {
var conString = "postgres://ali#localhost/rest";
var client = new pg.Client(conString);
client.connect(function(err) {
if(err) {
return console.error('could not connect to postgres', err);
}
client.query('SELECT * from ' + req.params.schema +'.'+ req.params.relation , function(err, result) {
if(err) {
return console.error('error running query', err);
}
res.send(JSON.stringify(result.rows));
client.end();
});
});
});
app.listen(port);

Answer 2

If your goal is to deliver different content to a human accessing the api URL with a browser, you can have your Express site check the request header Accept. If Accept is "text/html" service a HTML page with whatever it is you want (data formatted in a layout or API documentation for that method etc.), if Accept is "application/json" serve the API Data.
If it's security and authentication you're after, that's a different matter :-)