CODEWITHSUNDEEP
javascriptmongodbmongoose
relentless-coder
relentless-coder

Reputation: 1536

Delete a property from a returned mongoose document instance. MongoDB

Here is the situation, I have created a jwt token which depends upon the user document, but the problem is that for security purposes I don't want to include the password field in the user object that is passed into my encode function.

router.post('/admin/login', (req, res, next)=>{
  passport.authenticate('local-login', (err, user, info)=> {
    if (err) {
      return next(err);
    }else if (!user) {
      return res.json(info)

    }else {
      user.toObject();
      delete user.password;
      console.log(`User is ${user}`);
      let token = encode(user, 'inav');
      return res.send(token)
    }

  })(req, res, next);
})

I've tried this, but this isn't working. The user still contains the password

Upvotes: 0

Views: 338

Answers (1)

Raunak Mukhia
Raunak Mukhia

Reputation: 388

If https://github.com/jaredhanson/passport-local is the passport strategy you are using, it returns a mongoose model. You must convert it to a plain object to be able to delete password property. toObject returns an object which must be stored in a variable. 

const userObj = user.toObject();
delete userObj.password;
console.log(`User is ${userObj}`);
const token = encode(userObj, 'inav');

http://mongoosejs.com/docs/api.html#document_Document-toObject

Upvotes: 1

Related Questions