Best way to secure single page apps?

[Br LRd]

I'm running into a problem with the URL fragments ("#example") are only
sent client-side, thus
you can't use them to differentiate directories in apache conf and can't
think of a smart way to secure the web-app.
Let's say the page is 'www.portal.com/app', and navigating changes the
fragment at the end,
e.g to 'www.portal.com/app#page2'. Securing '/' would mean user is directed
to log in without even seeing a landing page, not securing it would mean
nothing on the SPA is secured.
I thought about adding a separate landing page and exempting it from
security, but you can't redirect there from '/' because the root would be a
portal to multiple sites, and redirecting from 'app/' causes recursive
redirection, so you'd have to type out the full path to the separate page
every time.

Tried googling but didn't find any relevant results, anyone have any ideas?
Oh and also, can you (and how) check shibboleth session (if there's an
active one) in apache .conf files?
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://shibboleth.net/pipermail/users/attachments/20161129/fe64d692/attachment.html>