From b9bdee10d394348529d25c8e962d42f69b85c6d8 Mon Sep 17 00:00:00 2001
From: Dave Landry <landry.dave@gmail.com>
Date: Thu, 30 Sep 2021 09:19:11 -0400
Subject: [PATCH] removes password and salt from isAuthenticated response

---
 packages/core/src/auth/auth.js | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/packages/core/src/auth/auth.js b/packages/core/src/auth/auth.js
index da5d0be78..f21809c18 100644
--- a/packages/core/src/auth/auth.js
+++ b/packages/core/src/auth/auth.js
@@ -41,7 +41,12 @@ module.exports = function(app) {
     })
   );
 
-  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => res.json({...req.user, authenticated: true}));
+  app.get("/auth/isAuthenticated", isAuthenticated, (req, res) => {
+    const sanitizedUser = {...req.user, authenticated: true};
+    delete sanitizedUser.password;
+    delete sanitizedUser.salt;
+    return res.json(sanitizedUser);
+  });
 
   app.get("/auth/logout", (req, res) => {
     req.logout();