Add security to database through backend route

[NwinNwin]

How to find the bug:

• Sign out of ZotnFound → Right click home page → inspect element → network → refresh page
• There will be a bunch of information, we primarily are focusing on the leaderboard/ and items/

• Double clicking either of these two will show a json of all sensitive data (specifically email) 😢

Why is this:

• We are currently are using a SQL query that is retrieving all the data with *

  

• We want to retrieve everything but the user’s emails!!

How To Fix:

• You can checkout the database schema in backend → server/database.sql

• In backend → routes/items.js

• Replace the SQL query in the GET “/” request to retrieve everything except the email

• Create a new GET request that takes in a item id and retrieves back ONLY the email associated with this item id

• Use middleware.decodeToken to verify if they logged in

  - Example (backend --> routes/items.js):

  

• When a user clicks on View Contact on an item, make a request call to the new route that you just created, passing in the current item id

  • only then, will we ever get to see the email of an item
  • 

• Use Authorization in headers to pass in authentication token when making API call to bypass backend’s middleware

• An example is in component/InfoModal.jsx

•