Node js remove sensitive data from object before sending it

Question

I want to remove some sensitive data from the array before sending to the client (to render all the users), but for some reason I can't actually remove them! I need to remove some usernames, passwords, emails etc. Is there something with splice() ? Thank you for helping me!

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    usersArray[a].userData.username.splice(0, 1); // here's my error
    usersArray[a].userData.email.splice(0, 1); // end here
    usersArray[a].userData.password.splice(0, 1); // and also here
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })

}

By the way, the error I get is "TypeError: undefined is not a function". Thanks again!

Strings do not have a `splice` method, see https://stackoverflow.com/questions/20817618/is-there-a-splice-method-for-strings — LeartS, Dec 22 '15 at 14:53
@LeartS I presume the `username`, etc. objects are arrays of usernames, etc., not strings. (It wouldn't make sense to chop off the first char of a string to censor something, anyway.) — tckmn, Dec 22 '15 at 14:54
How are we supposed to help you if you don't tell us what the structure of the entries in `usersArray` is? — T.J. Crowder, Dec 22 '15 at 14:54
@Doorknob冰 I think you presume wrong, the error suggests he's trying to use `splice` on an object that does not have the `splice` method. The array is `usersArray` and he gets the single user object by indexing it. — LeartS, Dec 22 '15 at 14:56
@LeartS Ah, you're right; I didn't see the last line of the question. — tckmn, Dec 22 '15 at 14:57

T.J. Crowder · Accepted Answer · 2015-12-22T16:16:03.400

I'll take a wild guess that you want to remove username, email, and password entirely. If so, you're looking for delete, which removes properties from objects:

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    var userData = usersArray[a].userData;
    delete userData.username;
    delete userData.email;
    delete userData.password;
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })
}

If those propeties are non-configurable, delete can't remove them, and you have to make do with setting their values to undefined:

app.get('/users', function(req, res){ Users.find{}, function(err, usersArray){
  for(var a = 0; a < usersArray.length; a++){
    var userData = usersArray[a].userData;
    userData.username = undefined;
    userData.email = undefined;
    userData.password = undefined;
    ...
  }
  res.render('users.ejs', {
    // and the variables go here...
  })
}

If they're both non-configurable and non-writable, you'll have to create replacement objects instead.

Live Example using delete:

var usersArray = [{
  userData: {
    name: "User 1", // Something to have left after we remove the others
    username: "user1",
    email: "user1@example.com",
    password: "pa$$word"
  }
}, {
  userData: {
    name: "User 2",
    username: "user2",
    email: "user2@example.com",
    password: "pa$$word"
  }
}, {
  userData: {
    name: "User 3",
    username: "user3",
    email: "user3@example.com",
    password: "pa$$word"
  }
}];
snippet.log("Before: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  delete userData.username;
  delete userData.email;
  delete userData.password;
}
snippet.log("After: " + JSON.stringify(usersArray, null, 2));

<!-- Script provides the `snippet` object, see http://meta.stackexchange.com/a/242144/134069 -->
<script src="//tjcrowder.github.io/simple-snippets-console/snippet.js"></script>

Live Example with non-configurable properties using undefined:

function makeUserData(name, username, email, password) {
  var ud = {name: name};
  Object.defineProperty(ud, "username", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: username
  });
  Object.defineProperty(ud, "email", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: email
  });
  Object.defineProperty(ud, "password", {
    enumerable: true,
    configurable: false,
    writable: true,
    value: password
  });
  return ud;
}
var usersArray = [{
  userData: makeUserData("User 1", "user1", "user1@example.com", "pa$$word")
},{
  userData: makeUserData("User 2", "user2", "user2@example.com", "pa$$word")
},{
  userData: makeUserData("User 3", "user3", "user3@example.com", "pa$$word")
}];
snippet.log("Before: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  delete userData.username;
  delete userData.email;
  delete userData.password;
}
snippet.log("After delete: " + JSON.stringify(usersArray, null, 2));
for (var a = 0; a < usersArray.length; a++) {
  var userData = usersArray[a].userData;
  userData.username = undefined;
  userData.email = undefined;
  userData.password = undefined;
}
snippet.log("After assigning undefined: " + JSON.stringify(usersArray, null, 2));

<!-- Script provides the `snippet` object, see http://meta.stackexchange.com/a/242144/134069 -->
<script src="//tjcrowder.github.io/simple-snippets-console/snippet.js"></script>

When I have the code like this, it seems to run with no errors, but it still won't work! I also console.log() the array and it still has all the sensitive data in it. Just for clarification userData is an array, the rest of them (username, email, password etc) are just strings that I have to remove. — Jim The Greek, Dec 22 '15 at 16:03
@JimTheGreek: Don't know what to tell you, if those properties exist on those objects and they're not non-configurable, `delete` will remove them. If they're non-configurable, you can set them to `undefined`. — T.J. Crowder, Dec 22 '15 at 16:10
@JimTheGreek: And if they're non-writable, you'll have to create whole new objects with just the properties you want. — T.J. Crowder, Dec 22 '15 at 16:16

Node js remove sensitive data from object before sending it

1 Answers1