我怎么能只允许从门户进入我的虚拟场景？

const express = require('express');
const app = express();

app.use((req, res, next) => {
  const authHeader = req.headers.authorization;
  if (!authHeader) {
    res.set('WWW-Authenticate', 'Basic realm="Access to the virtual scene"');
    res.status(401).send('Access denied');
    return;
  }

  const credentials = Buffer.from(authHeader.split(' ')[1], 'base64').toString('ascii');
  const [username, password] = credentials.split(':');

  if (username === 'allowedUser' && password === 'allowedPassword') {
    next();
  } else {
    res.status(401).send('Access denied');
  }
});

app.get('/virtual-scene', (req, res) => {
  res.send('Welcome to the virtual scene!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});

const express = require('express');
const jwt = require('jsonwebtoken');
const app = express();

app.use(express.json());

const verifyToken = (req, res, next) => {
  const token = req.headers['authorization'];
  if (!token) {
    return res.status(403).send('Access denied');
  }

  try {
    const verified = jwt.verify(token, 'your_jwt_secret');
    req.user = verified;
    next();
  } catch (err) {
    res.status(400).send('Invalid token');
  }
};

app.post('/login', (req, res) => {
  const user = { id: 1, username: 'allowedUser' };
  const token = jwt.sign(user, 'your_jwt_secret', { expiresIn: '1h' });
  res.json({ token });
});

app.get('/virtual-scene', verifyToken, (req, res) => {
  res.send('Welcome to the virtual scene!');
});

app.listen(3000, () => {
  console.log('Server is running on port 3000');
});