I have a database in MongoDB/Mongoose where I store user information, including passwords. However, when I want to display a list of contacts on the frontend, I don't want to include the passwords for security reasons.
To achieve this, I attempted to remove the password field from each user object before sending the list back to the client:
readAll(req, res, next) {
User.find()
.then(users => {
users.forEach(user => {
delete user.password;
});
res.send(users);
})
.catch(next)
},
However, my current implementation is not working as expected. Even though delete user.password returns true, the password field remains untouched due to it being part of the prototype in Mongoose's ModelSchema.
After researching potential solutions on MDN (https://developer.mozilla.org/en-US/docs/Web/JavaScript/Reference/Operators/delete), I tried removing the password property directly from the User prototype like so:
delete User.prototype.password;
Unfortunately, this approach also did not work as intended. So, I'm seeking advice on how to effectively remove the password field from each user object in my scenario. Any help would be greatly appreciated. Thank you!