我不想用快递发回表单数据，但它确实如此，还是它？

Question

I know the title of this question might sound confusing, but my problem is actually simple. I have these two handlers for /login get and post requests:

loginRender(req, res) {
        let options = { title: 'Login', layout: 'auth.hbs' }
        res.render('login', options)
}
login (req,res){
        let user = Routes.findUser(req.body.username)
        let passwordCorrect = Routes.hashCompare(
            req.body.password,
            user.password
        )
        if (passwordCorrect) {
            let token = Routes.jwtsign(req.body.username)
            let refreshToken = Routes.jwtRefreshToken(req.body.username)
            Routes.authRedirect(res, token, refreshToken)
        } else {
            Routes.badRequestRedirect(res, '/login')
        }
}
authRedirect(res, token, refreshToken )
{
        let options = {
            cssPath: 'styles/querystyle.css',
        }
        res.cookie('access_token', `${token}`, { httpOnly: true })
        res.cookie('refresh_token', `${refreshToken}`, { httpOnly: true })
        res.status(200).render('query', options)
}
// app.use(urlencoded)
// app.use(cookieParser)
// app.post('/login', login)';
// app.get('/login', loginRender)

Please, ignore all unrelated stuff.

So, everytime I complete login, I get my webpage rendered and I can actually open inspector and see this:

Page Inspector

Address line

How can I fix that? I want my user to be redirected to dashboard-like page and not to receive his sensitive data in insecure form.

UPD

there's also auth middleware that only appends req.username in case we did parse jwt successfully, and there's a little bit of interaction with it, but it does not appear on page until I go to this page manually by writing the address in address line.

Answer 1

If you don't send the data to the Express server, then you can't read it in you login function and you can't authenticate the user.

It is not a problem is the user can use the tools in their own browser to inspect the data that they entered.

You need it to be encrypted in transport (ie use HTTPS and not plain HTTP, at least in production) but you don't need to worry about the user finding out their own password.