Architecture: Login endpoint returns full user object including password hash in JSON response, enables potential hash extraction #698

res.status(200).json({ message: 'Login successful', user: req.user });

router.post("/login", validateRequest(loginSchema), 
  passport.authenticate('local'), 
  (req, res) => {
    // Extract only safe fields
    const safeUser = {
      id: req.user._id,
      username: req.user.username,
      email: req.user.email,
      // Don't include: password, passwordHash, __v
    };
    
    res.status(200).json({
      message: 'Login successful',
      user: safeUser
    });
  }
);

// Or define a toJSON method in User model
UserSchema.methods.toJSON = function() {
  const obj = this.toObject();
  delete obj.password;  // Exclude password from JSON
  return obj;
};

// Then simpler response
res.status(200).json({
  message: 'Login successful',
  user: req.user.toJSON()
});