removes password and salt from isAuthenticated response

Datawheel · Sep 30, 2021 · b9bdee1 · b9bdee1
1 parent 76c7574
commit b9bdee1
Showing 1 changed file with 6 additions and 1 deletion.
diff --git a/packages/core/src/auth/auth.js b/packages/core/src/auth/auth.js
@@ -41,7 +41,12 @@ module.exports = function(app) {
     })
   );
 
-  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => res.json({...req.user, authenticated: true}));
+  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => {
+    const sanitizedUser = {...req.user, authenticated: true};
+    delete sanitizedUser.password;
+    delete sanitizedUser.salt;
+    return res.json(sanitizedUser);
+  });
 
   app.get("/auth/logout", (req, res) => {
     req.logout();