As Mike pointed out, the code from my blog really shows you how to set up a route file so that only certain routes are available in Dev or Prod mode. So that...
%{ if (play.mode.isDev()) { }% GET /route4 Application.noProd GET /route5 Application.noProd GET /route6 Application.noProd %{ } }%
However, this will really prevent these routes from working in Prod mode, but they will not exclude access to the controller. The reason for this is that it is more likely that the following will be indicated at the bottom of your routes file:
* /{controller}/{action} {controller}.{action}
This means that I can access the Application.noProd action using the catch all route, which will be the following URL
/application/noprod
So. If you want to hide your routes and controllers, you have several options.
You can delete the entire route so that there is no entry other than the routes you have defined. This means that you need to specify all routes for all actions in your routes file.
Secondly, you can check play.mode.isDev() in your actions and call badRequest() to prevent access. This would make it much more noticeable, but may be an unacceptable coding overhead.
source share