Multi tool use

Retrieving User Collection from API / MongoDB but exclude Password Field?

I am constructing an api which retrieves articles. I also have users in my database, and would like to have one endpoint which returns the user. /api/users/:userid. This returns something along these lines:

/api/users/:userid

{
"articles": , //array w. references to articles the user has written
"_id": "5b1321321bcda0e3364251d7e4a",
"email": "user@email.com",
"password": "$2a$1231241gi14k41k42bk12bh3k127iP/k1LAqwPdbgF/bXXpRia",
"__v": 0
}


-- However, I am not sure whether it's a good idea to return the (encrypted) password in the API. Can I somehow exclude this field, or would you recommend to store emails + user_ids in a separate collection on mongodb, or how are things like this usually handled?

2 Answers
2

you can use Project Fields to Return from Query to exclude password field from your response.

Project Fields to Return from Query

db.users.find( { email: "user@email.com" }, { password: 0} )


0

-1

0

-1

Alright It is not best practice and advisable to return a user's password. What I normally do is use the lodash library for operations like this for example, you can have a utility function that omits the password field before your API returns a response like so

password

lodash

function omitPassword(user) {
return _.omit(user.toObject(), ['password']);
}

basically _.omit is a method from lodash. I hope this helps what you are looking for.

function omitPassword(user) {
return _.omit(user.toObject(), ['password']);
}


_.omit

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.