My website currently features a large structure where all content is loaded in the index.html file. The initial landing page for users is the login screen, but because it is also within index.html, the entire website can be accessed and downloaded without requiring a login. This exposes my routes as well. While I understand the challenges of securing JavaScript code on the client side, I would like to at least prevent anonymous users from viewing it.
The backend of my site is ASP.NET hosted on Azure. Addressing this issue seems relatively straightforward on a LAMP stack, but I am unsure of the best approach in this environment.
Is it necessary for everything to load on a single page, or could I potentially redirect the browser elsewhere?
I have considered injecting script tags onto the page after a successful login from the server side, but this solution doesn't sit right with me.