I'm facing a dilemma and can't seem to figure out why I'm unable to resolve my issue.
My SPA is created using AngularJS, Node.JS, and MongoDB (Mongoose). On the client side, I have a registration form for new users. The form includes a text input with an associated function triggered by its onblur event (ng-blur to be exact). This function makes an AJAX/$http call to the backend to check if the username is unique before submitting the form. Everything seems to be working fine, here's the code snippet I've been working on (lightly modified for this question)...
Here's the input box,
<input type="text" name="displayName" id="displayName" ng-model="user.displayName" ng-blur="checkUserName(user)" />
And here's the blur function in my controller
this.userNameCheck = function(user){
return $http({method: 'GET', url: '/api/users/displayName/' + user.displayName})
.then(function(response) {
if(response.data.length > 0){
user.userWarning = userWarning; // userWarning is a string/ var that is passed to the form
}
}, function(response) {
console.log(response);
});
};
Lastly, here is the Node/mongoose code from another project:
exports.displayName = function (req, res, next, displayName) {
User.find({displayName : displayName}).limit(1).exec(function (err, results) {
if (err) return next(err);
if (!results) return next(new Error('No user found'));
res.jsonp(results || null);
});
};
Everything seems fine, however, upon checking the console, it appears that when there's a match, the returned results object contains sensitive information like hashed password and salt. To address this, I updated my backend code as follows:
exports.displayName = function (req, res, next, displayName) {
User.find({displayName : displayName}).limit(1).exec(function (err, results) {
if (err) return next(err);
if (!results) return next(new Error('No user found'));
// Updated code
if(results.length !== 0){
var returnObj = results[0];
delete returnObj.hashed_password;
delete returnObj.salt;
delete returnObj._id;
res.jsonp([returnObj] || null)
}else{
res.jsonp(results || null);
}
});
};
However, even after implementing these changes, when making a successful call in Firebug (resulting in a match), the returned object still contains the deleted properties. What am I doing wrong?