title: The correct way of accessing user data within page rendering in EJS
body: <p>I have an app where like most apps users register and their data is saved in a user document in MongoDB using Mongoose.</p>
  
  <p>Now the important point to know is that I am using Node.js &amp; rendering my pages within each route, using the EJS Tempting engine.</p>
  
  <p><strong>An Example of rendering pages:</strong></p>
  
  <pre><code> app.get('/profile',isLoggedIn,function(req, res) {
      res.render('profile.ejs', {
          user: req.user
      });
  });
  </code></pre>
  
  <p>Now you can see in the above code that Im checking whether the user is loggedIn &amp; then passing the user object to my template. The user object contains the whole user document for the signed in user.</p>
  
  <p><strong>How I use the User Object:</strong></p>
  
  <p>On the front end when the user access their profile, I use the <code>user: req.user</code> object to access the signed users document <code>ID</code> and use that I'd to get information related to that user.</p>
  
  <p>For example:</p>
  
  <ol>
  <li>Get all comments matching the logged in users ID</li>
  <li>Get all posts matching the logged in users ID</li>
  </ol>
  
  <p><strong>Heres an example of it:</strong></p>
  
  <pre><code>&lt;body ng-init="getUserPosts('&lt;%= user._id %&gt;')"&gt;&lt;/body&gt;
  </code></pre>
  
  <p>The above works perfectly, I use the same technique many times, overtime I need the users ID to get data related to that user or post to that user account, for example:</p>
  
  <pre><code>&lt;button ng-click="savePost('&lt;%= user._id %&gt;')"&gt;Send&lt;/button&gt;
  </code></pre>
  
  <p>The above finds the user with the given ID (which is always the loggedIn user) saves the posts to their account.</p>
  
  <p><strong>The Issue:</strong></p>
  
  <p>Now my code works perfectly I have had no issues but I noticed that when I inspect element my page in any browser I can clearly see the Users ID. Below is an image to help understand what I mean:</p>
  
  <p><a href="https://i.stack.imgur.com/pXPFR.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pXPFR.png" alt="enter image description here"></a></p>
  
  <p><strong>Now I understand that only the loggedIn user will able to view only their own ID. But still is this the correct way? Is this harmful? How can I improve on this?</strong></p>