This issue was raised when discovering that the backend was sending the passwords to the client/consumer, which is really bad.
We are currently returning the raw unaltered database objects which is bad practice.
There are security concerns of exposing some of that information as it reveals the inner workings of the backend.
a lot of the time the data sent to the client/consumer is irrelevant. This could be metadata stored on the database object like the __v version key.
In some cases the data is only relevant to the backend so it can chain together operations and therefore shouldn't be sent to the client/consumer.
We should have a system in place for easier control of the data, so a dev would need to specify which fields should be included in the response. This could be something like a DTO pattern or a response mapper
This issue was raised when discovering that the backend was sending the passwords to the client/consumer, which is really bad.
We are currently returning the raw unaltered database objects which is bad practice.
__v
version key. In some cases the data is only relevant to the backend so it can chain together operations and therefore shouldn't be sent to the client/consumer.We should have a system in place for easier control of the data, so a dev would need to specify which fields should be included in the response. This could be something like a DTO pattern or a response mapper