Merge pull request #1260 from Datawheel/core-user-security

[core] removes password and salt from isAuthenticated response
Datawheel · Sep 30, 2021 · 782e266 · 782e266
2 parents 76c7574 + b9bdee1
commit 782e266
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/packages/core/src/auth/auth.js b/packages/core/src/auth/auth.js
@@ -41,7 +41,12 @@ module.exports = function(app) {
     })
   );
 
-  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => res.json({...req.user, authenticated: true}));
+  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => {
+    const sanitizedUser = {...req.user, authenticated: true};
+    delete sanitizedUser.password;
+    delete sanitizedUser.salt;
+    return res.json(sanitizedUser);
+  });
 
   app.get("/auth/logout", (req, res) => {
     req.logout();