[BUG] Full user record is getting attached req.user

[ethnic17]

Browser

Chrome

Area

Auth (login / Google sign-in)

Steps to reproduce

1. Check the attachUser function in auth.js middleware.
2. Notice that it finds user based on userId provided by cookie and attaches the whole user object from database to req.user
3. Login using /dev-login so that splitt cookie is set and access any route protected by requireAuth.
4. The /me route selects particular data from req.user but full user data is still available for downstream routes/controllers.
5. If suppose a downstream route directly returns req.user, then the sensitive fields might be exposed accidently.

Expected behavior

The auth.js middleware should only attach safe user fields to req.user object.

What actually happened

The auth.js middleware attaches the whole user object from the database to 'req.user', as Prisma findUnique() returns the whole object.

Logs / Screenshots

No response

[Harshbansal06]

/assign
Hi @ethnic17 ! I'd love to take this issue and fix it.

I can update the attachUser middleware in auth.js to use Prisma's select ,so that we only query and attach safe user fields to req.user. This will prevent any accidental downstream leaks.

please assign this issue to me. Thanks!

[AniketSingh16742]

Hi @ethnic17 , i would love to work on this issue I saw the auth.js middleware problem which you mentioned. I can make sure to fix this as soon as possible, if this issue is still open please assign it to me.

[legendaybiwan]

Hi @ethnic17 , I would like to contribute in this project. I can update the attachUser middleware in auth.js to use Prisma's select ,so that we only query and attach safe user fields to req.user

[ethnic17]

To solve this, we will use Prisma select inside prisma.user.findUnique() in attachUser() function in auth.js middleware and select the fields that we want the req.user to contain.
Please assign it to me.

[BitForge95]

@ethnic17 This mainly a backend issue and we would merging at a later phase , for now i am assigning this issue , let us know your approach and implementation.