Question

I want result to be sent without password. Then I do:

Delete req.session.user.password
res.send(req.session.user)

Password still remains there. Why?
How can I delete a property that I don’t want to response back?

Answer 1

You need to convert your mongoose user model object into a plain JavaScript object before deleting the password.

var user = req.session.user.toObject();
delete user.password;
res.send(user);