example.js

const express    = require('express');
const app        = express();
const server     = app.listen(3012);

app.get('/', (req, res) => {
  res.send('open route');
});

const router = express.Router();

router.get('/', (req, res) => {
  res.send('protected route');
});

router.use((req, res, next) => {
  res.status(404).send('protected route not found');
})

app.use('/protected', (req, res, next) => {
  if (! req.headers.authorization) {
    return res.status(403).json({ error: 'No credentials sent!' });
  }
  next();
}, router);

app.use((req, res, next) => {
  res.status(404).send('open route not found');
})