From 4cdeb5525ae0cc2eac43b485f9909221b51b613d Mon Sep 17 00:00:00 2001 From: Tim Howitz Date: Wed, 28 May 2025 21:51:54 +0100 Subject: [PATCH] Removed passwordHash when returning user after login --- src/app/api/login/route.ts | 5 ++--- 1 file changed, 2 insertions(+), 3 deletions(-) diff --git a/src/app/api/login/route.ts b/src/app/api/login/route.ts index 3afca94..38341b5 100644 --- a/src/app/api/login/route.ts +++ b/src/app/api/login/route.ts @@ -23,8 +23,6 @@ export async function POST(req: Request) { }); if (user && bcryptjs.compareSync(password, user.passwordHash)) { - // todo remove password from returned user - // get user and relations user = await prisma.user.findUnique({ where: { id: user.id }, @@ -42,6 +40,7 @@ export async function POST(req: Request) { }, }, }); + const { passwordHash, ...userSansHash } = user!; const secret = new TextEncoder().encode(env.JWT_SECRET_KEY); const token = await new SignJWT({ userId: user!.id }) @@ -49,7 +48,7 @@ export async function POST(req: Request) { .setExpirationTime("2w") .sign(secret); - const response = NextResponse.json({ message: "Login successful!", user, token }, { status: 200 }); + const response = NextResponse.json({ message: "Login successful!", user: userSansHash, token }, { status: 200 }); response.cookies.set("jwt", token, { httpOnly: true, secure: process.env.NODE_ENV === "production",