ASP.NET Core 3.1 Web API: how to protect sensitive data from return with model?

Question

I have a Posts model class that has a relation with Users model. When I call API to get Posts with the owner of it (user), it returns with all user info including password.

How to prevent model from returning sensitive information like passwords?

Answer 1

You should create new classes that you return from your actions. Only include the fields/information you want to return. These classes are also known as Data Transfer Objects (DTO).

Answer 2

You can use [JsonIgnore] to avoid serializing the property value:

public class Users 
{
    public int Id { get; set; }
    [System.Text.Json.Serialization.JsonIgnore]
    public string Password{ get; set; }
    //...
}