codejump
MediumPro challengeJavaScriptTypeScript

Password Hash Leak — Strip Sensitive Fields Before Sending

TypeScriptSecuritySensitive Data Exposure

An API endpoint returns "the current user's profile" by sending back the full database record.

The bug: the database record includes passwordHash — a field that should never leave the server. This is Juice Shop's very first listed challenge, "Password Hash Leak": obtain a user's password hash directly from a REST API response that was never supposed to include it.

Your task: fix solve(user) so the returned object has every field from user except passwordHash.

Sample tests

Test #1passwordHash stripped from customer record
Input: [{"id":"u1","role":"customer","email":"alice@example.com","passwordHash":"$2b$10$abcdefgh"}]
Output: {"id":"u1","role":"customer","email":"alice@example.com"}
Test #2passwordHash stripped from admin record too
Input: [{"id":"u2","role":"admin","email":"admin@example.com","passwordHash":"$2b$10$zzzzzzzz"}]
Output: {"id":"u2","role":"admin","email":"admin@example.com"}
Test #3Works for any role value, always strips the hash
Input: [{"id":"u4","role":"moderator","email":"carol@example.com","passwordHash":"$2b$10$qwerty12"}]
Output: {"id":"u4","role":"moderator","email":"carol@example.com"}
← All challenges