title: How to hide HTML and other Content in EJS and Node
body: <p>Having a tough time doing a simple web site in EJS. </p>
  
  <p>I have this set up in my server file:</p>
  
  <pre><code>    //Use the .html extension instead of having to name the views as *.ejs
      server.engine('.html', require('ejs').__express);
  
      // This avoids having to provide the extension to res.render()
      server.set('view engine', 'html');
  
      //set up directory to serve css and javascript files
      server.use(Express.static(__dirname, '/views'));
  </code></pre>
  
  <p>This works great. I have HTML files, I have graphics, I have CSS. I am serving it up with a simple controller that renders the page. Nothing dynamic in these pages. But I do want them protected with an id/password system, and only served up through Express. </p>
  
  <p>The access works fine, I have an end point set up to serve them. I'm forcing log in in that end point. But the problem is, that if someone knows the actual path to those files, they can get at them. So, the access is localhost:8081/admin/documentation/. However, the files are at /views/app_documents. And by entering in localhost:8081/views/app_documents/file_name.html, they can download/view the content, without going through my controls. I moved the content out of views, and grab it in my code, and serve it up, but that doesn't work for images or CSS.</p>
  
  <p>Any suggestions for how to get around this?</p>