GET api/User by Id returns session_token

[MauriceNino]

Expected Behavior

Return only a slice of the data (the non-private data, like description, name, ...), when called without Bearer/Or with a Bearer that does not belong to the user

Current Behavior

Returns whole user object

Possible Solution

/

Detailed Description

GET http://localhost:50606/api/User/id returns session

[Steffx115]

Removed current session when not logged in with the correct user -> need to clarify what exactly to remove in this case, only removing current session is only the first step

[MauriceNino]

Should be visible by everyone:

• public ObjectId _id { get; set; }
• public DateTime CreateTime { get; set; }
• public string ProfileName { get; set; }
• public string ProfileDescription { get; set; }
• public string ProfilePicture { get; set; }
• public DateTime Birthday { get; set; }
• public ObjectId Country { get; set; }
• public List Languages { get; set; }
• public string Gender { get; set; }
• public ObjectId Role { get; set; }

Should only be visible by friends:

• public string OnlineStatus { get; set; }
• public List ActiveSearches { get; set; }
• public List PassiveSearches { get; set; }

Should only be visible by yourself:

• public string GoogleId { get; set; }
• public CurrentSession CurrentSession { get; set; }
• public Karma Karma { get; set; }
• public List GamesSelected { get; set; }
• public List FriendsList { get; set; }
• public List RecievedFriendRequests { get; set; }
• public List SentFriendRequests { get; set; }
• public List PrivateChats { get; set; }
• public List Notifications { get; set; }
• public List ConnectedServices { get; set; }
• public bool ProfileComplete { get; set; }

Thats what I thought. Any problems with it @Steffx115 ?