CODEWITHSUNDEEP
node.jsexpresspassport.jsexpress-session
Robin
Robin

Reputation: 1967

Is the req.user passed to the client?

I'm using node.js, express, express-session and passport.js to handle authentication in my project. In my routes.js I handle get-requests like this:

app.get('...', isLoggedIn, function(req, res, next) {
    var user = req.user;
    ...
});

Inside the function I can get the user from the request parameter. My question is where the user object comes from? Is the user object passed to the client and back? Can the client change the user object in an attempt to inject code into my database?

Thanks in advance!

Upvotes: 1

Views: 451

Answers (1)

Luka Krajnc
Luka Krajnc

Reputation: 915

req.user is intialized when session is created. req.user is equal to object user stored in session. Watch this video for more informations about authentication in node.js .And no, client cannot interact with you database through that.

Upvotes: 1

Related Questions