title: ExpressJS restricting access to public files
body: <p>Is there a way to hide files that are being served by the Node server?  I have tried to reroute certain files and directories, but nothing is working in Express 4.X.  I have also tried to send 4XX HTTP responses when certain files are requested, but this only works for directory paths.  No matter what I do, if there is a file that is being served by Node, then the user is going to be able to see the source code.  Is this just how Express works?  Is it meant to be a development framework over a production framework?</p>
  
  <p>Right now I am trying to send bad responses.  </p>
  
  <p><strong>full server.js</strong></p>
  
  <pre><code>var path = require('path'),
     express = require('express'),
  
  var app = express();
  
  app.use('/', express.static(__dirname));
  app.use('/', express.static('dist'));
  
  // not working
  app.get('/client/config/app.js', function(req, res) {
     res.sendStatus(400);
  });
  
  app.listen(3001, function() {
     console.log('listening');
  });
  </code></pre>
  
  <p>I am able to send a response if I specify a directory path, but not if I specify a full file path.  This works:</p>
  
  <pre><code>app.get('/client/config/', function(req, res) {
     res.sendStatus(400);
  });
  </code></pre>
  
  <p>And this doesn't:</p>
  
  <pre><code>app.get('/client/config/app.js', function(req, res) {
     res.sendStatus(400);
  });
  </code></pre>
  
  <p>I've also tried routing with <code>app.use</code>.  That didn't work either.  </p>
  
  <p>The best thing I can do right now to "hide" the source code is to uglify it with Gulp, but I imagine it's easy to unravel it with a JS prettifier.  </p>