Open fancyoung opened 2 years ago
passport-local
usually puts puts the username and password into req.user
. koa
has ctx.state
for custom data, which is why the object is put into ctx.state.user
instead.
What's
ctx.state.user
used for ? Should I wrap(removepassword
) it before pass to frontend, or I made some mistake ?
Yes, you should definitely not return the password to the frontend (and also don't have it as plain text available in the database object). I think most passport-local
usages serialize and deserialize the user by its ID (and not the whole object), see e.g. https://github.com/rkusa/koa-passport-example/blob/master/auth.js#L11-L13).
When I use
koa-passwort
withpassport-local
, user database info such aspassword
are inctx.state.user
.What's
ctx.state.user
used for ? Should I wrap(removepassword
) it before pass to frontend, or I made some mistake ?