node.js - Utilize, but don't expose API (AngularJs/NodeJs) -

i have angularjs application consumes api. made api strongloop

what want:

1. be able consume api via angularjs controllers.
2. not expose api endpoints user.

now thinking somehow able node, query local site url angularjs , have node process routing , authentication token, stops user using local url results?

i want website consume api, not provide results user if navigate themselves

that's thing, on http level, there no difference between two.

now may implement authentication , authorization system in place. authentication identifies client/user, , authorization decides whether given user can perform given action or not.

to implement above, please refer strongloop's authentication, authorization, , permissions

public apis

if api accessible angularjs controller (a web client), assume accessible user "putting api url in browser". there's no way around this, both valid clients api.

if need manage permissions, don't rely on client side prevent user doing it, rely on server side.

permissions on client side ux (user experience, e.g. hide buttons actions user isn't allowed perform).

the api doesn't trust client.

internal apis

once have secured public apis, may have internal apis listen requests node.js app provide specific service e.g.

public clients (ng-app, web browser) ---> public api (node.js) ----> internal api 

here may have internal api trust requests coming node.js app, because public api deals permissions , calls internal api safe operations.