{"action":"created","issue":{"url":"https://api.github.com/repos/linnovate/mean/issues/1011","labels_url":"https://api.github.com/repos/linnovate/mean/issues/1011/labels{/name}","comments_url":"https://api.github.com/repos/linnovate/mean/issues/1011/comments","events_url":"https://api.github.com/repos/linnovate/mean/issues/1011/events","html_url":"https://github.com/linnovate/mean/issues/1011","id":54332538,"number":1011,"title":"Hiding security sensitive fields in user model","user":{"login":"pratik60","id":2249430,"avatar_url":"https://avatars.githubusercontent.com/u/2249430?v=3","gravatar_id":"","url":"https://api.github.com/users/pratik60","html_url":"https://github.com/pratik60","followers_url":"https://api.github.com/users/pratik60/followers","following_url":"https://api.github.com/users/pratik60/following{/other_user}","gists_url":"https://api.github.com/users/pratik60/gists{/gist_id}","starred_url":"https://api.github.com/users/pratik60/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pratik60/subscriptions","organizations_url":"https://api.github.com/users/pratik60/orgs","repos_url":"https://api.github.com/users/pratik60/repos","events_url":"https://api.github.com/users/pratik60/events{/privacy}","received_events_url":"https://api.github.com/users/pratik60/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-01-14T15:10:01Z","updated_at":"2015-11-07T23:33:41Z","closed_at":"2015-11-07T23:33:41Z","body":"Specifically referring to this code in user.js :-)\r\n\r\n```\r\n  /**\r\n   * Hide security sensitive fields\r\n   * \r\n   * @returns {*|Array|Binary|Object}\r\n   */\r\n  toJSON: function() {\r\n    var obj = this.toObject();\r\n    delete obj.hashed_password;\r\n    delete obj.salt;\r\n    return obj;\r\n  }\r\n\r\n```\r\n\r\nIsn't this the better way? http://stackoverflow.com/questions/12096262/how-to-protect-the-password-field-in-mongoose-mongodb-so-it-wont-return-in-a-qu?rq=1\r\n\r\nYou can change the default behavior at the schema definition level using the select attribute of the field:\r\n\r\n```password: { type: String, select: false }```\r\nThen you can pull it in as needed in find and populate calls via field selection as '+password'."},"comment":{"url":"https://api.github.com/repos/linnovate/mean/issues/comments/154765183","html_url":"https://github.com/linnovate/mean/issues/1011#issuecomment-154765183","issue_url":"https://api.github.com/repos/linnovate/mean/issues/1011","id":154765183,"user":{"login":"VikramTiwari","id":1330677,"avatar_url":"https://avatars.githubusercontent.com/u/1330677?v=3","gravatar_id":"","url":"https://api.github.com/users/VikramTiwari","html_url":"https://github.com/VikramTiwari","followers_url":"https://api.github.com/users/VikramTiwari/followers","following_url":"https://api.github.com/users/VikramTiwari/following{/other_user}","gists_url":"https://api.github.com/users/VikramTiwari/gists{/gist_id}","starred_url":"https://api.github.com/users/VikramTiwari/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/VikramTiwari/subscriptions","organizations_url":"https://api.github.com/users/VikramTiwari/orgs","repos_url":"https://api.github.com/users/VikramTiwari/repos","events_url":"https://api.github.com/users/VikramTiwari/events{/privacy}","received_events_url":"https://api.github.com/users/VikramTiwari/received_events","type":"User","site_admin":false},"created_at":"2015-11-07T23:33:40Z","updated_at":"2015-11-07T23:33:40Z","body":"Old issue and unrelated now. If any questions please ask in gitter chatroom (https://gitter.im/linnovate/mean)."}}