javascript - Node http response returning user password to angular -

i using mean stack , trying set basic authentication. authentication works fine. process goes this:

1. angular posts user details "/login".
2. passport doing authentication , redirecting either "/login/success" or "/login/failure"

3. both routes return different simple json depending on result either:

   res.json({success:true,user:req.session.passport.user});

   or

   return res.json({success:false});

now, when console.log result angular right json. problem in config object still see user details in config object (username , password) posted initially.

i not sure if normal or not i'd return simple json , no additional data client.

this i'm getting in client. can see username , password in config object.

here little bit more code:

angular html form

            <form action="" ng-submit="submit()">                 <div class="form-group">                     <input ng-model="user.username" type="text" name="user" class="form-control" placeholder="username">                 </div>                 <div class="form-group">                     <input ng-model="user.password" type="password" name="pass" class="form-control" placeholder="password">                 </div>                 <button type="submit" class="btn btn-default">login</button>             </form> 

angular controller:

    $scope.submit = function() {         $http.post("/login", $scope.user).then(function(data) {             console.log(data);                     });     } 

node routes

app.post('/login', passport.authenticate('local', {      successredirect: '/login/success',     failureredirect: '/login/failure' }));  app.get('/login/success', function(req, res, next){     console.log("authentication successful");             res.json({success:true,user:req.session.passport.user});  });  app.get('/login/failure', function(req, res){     console.log("authentication failed");     res.json({success:false}); });