title: express-jwt setting user object to req.user._doc instead of just req.user?
body: <p>I've used the npm package express-jwt in the past for easy JWT signing, decoding, etc. Usually (and <a href="https://github.com/auth0/express-jwt" rel="noreferrer">according to the docs</a>) it intercepts a request, decodes the token with the user object payload and sets <code>req.user</code> to that payload. However, this time around it's showing that <code>req.user</code> looks like this:</p>
  
  <pre><code>{ '$__': 
     { strictMode: true,
       getters: {},
       wasPopulated: false,
       activePaths: { paths: [Object], states: [Object], stateNames: [Object] },
       emitter: { domain: null, _events: {}, _maxListeners: 0 } },
    isNew: false,
    _doc: 
     { __v: 0,
       password: '$2a$10$ypbCbWsEA7W17IQjdox5Oe..MhhCco/0yIw.J1Y6m6vJDllCB0LLS',
       username: 'b',
       lastname: 'Last',
       firstname: 'First',
       _id: '56969210e3f8bf2ab9aee66d' },
    _pres: { '$__original_save': [ null, null, null ] },
    _posts: { '$__original_save': [] },
    iat: 1452709101 
  }
  </code></pre>
  
  <p>Instead of just:</p>
  
  <pre><code>{
      __v: 0,
      password: '$2a$10$ypbCbWsEA7W17IQjdox5Oe..MhhCco/0yIw.J1Y6m6vJDllCB0LLS',
      username: 'b',
      lastname: 'Last',
      firstname: 'First',
      _id: '56969210e3f8bf2ab9aee66d'
  }
  </code></pre>
  
  <p>I'm trying to figure out why this time around I need to specify <code>req.user._doc</code> to get the specific info about the user. I've compared my code at every source and it's practically identical to a past project, and I just tested them side by side - one project sets req.user to the user object, the other sets req.user to the object shown above, where the user object can only be found in the <code>_doc</code> property.</p>
  
  <p>I checked what is actually getting returned from the mongoose <code>.findOne()</code> method in both projects and it <em>is</em> the larger object shown above in both projects, but express-jwt seems to be weeding out the extra stuff automatically in one project but not in the other.</p>
  
  <p>I've also noticed that the JWT with all the additional info I don't want is much longer than the JWT on the project with the correct <code>req.user</code> object. So perhaps that means something weird is happening when the JWT is getting signed with the payload...</p>
  
  <p>Here's the relevant code from the one that is requiring <code>req.user._doc</code>:</p>
  
  <h3>server.js</h3>
  
  <pre><code>...
  var expressJwt = require('express-jwt');
  var authRoutes = require('./routes/authRoutes');
  var nationRoutes = require('./routes/nationRoutes');
  ...
  app.use('/api', expressJwt({ secret: config.secret }));
  app.use('/api/nation', nationRoutes);
  app.use('/auth', authRoutes);
  ...
  </code></pre>
  
  <h3>authRoutes.js</h3>
  
  <pre><code>...
  authRouter.post('/login', function (req, res) {
      User.findOne({ username: req.body.username }, function (err, user) {
          if (err) res.status(500).send(err);
          if (!user) res.status(401).send('The username you entered does not exist');
          else if (user) {
              bcrypt.compare(req.body.password, user.password, function (err, match) {
                  if (err) throw (err);
                  if (!match) res.status(401).send("Incorrect Password");
                  else {
                      var token = jwt.sign(user, config.secret);
                      res.send({
                          user: user,
                          token: token
                      });
                  }
              });
          }
      });
  });
  ...
  </code></pre>
  
  <h3>nationRoutes.js (where the problem is manifesting itself)</h3>
  
  <p>By this point, express-jwt has decoded the token and (supposedly) set the token's payload (which is supposed to be just the user's info, not the additional <code>$__</code>, etc. stuff) to <code>req.user</code>, but I'm having to do <code>req.user._doc</code> as shown in the code below to get it to work.</p>
  
  <pre><code>...
  nationRouter.route('/')
      .get(function (req, res) {
          console.log(req.user);  // Shows the larger object with added stuff from above
          Nation.find({ user: req.user._doc._id }, function (err, nations) {
              if (err) {
                  res.status(500).send(err);
              }
              res.send(nations);
          });
      })
  ...
  </code></pre>
  
  <p>In case it's helpful, or possibly part of the problem, here is the user model and the nation model:</p>
  
  <h3>user.js</h3>
  
  <pre><code>var mongoose = require('mongoose');
  var Schema = mongoose.Schema;
  var bcrypt = require("bcrypt");
  
  var userSchema = new Schema({
      firstname: {
          type: String,
          required: true
      },
      lastname: {
          type: String,
          required: true
      },
      username: {
          type: String,
          required: true,
          unique: true,
          lowercase: true
      },
      password: {
          type: String,
          required: true
      },
      email: String
  });
  
  userSchema.pre("save", function (next) {
      var user = this;
  
      if (!user.isModified("password")) {
          next();
      }
  
      bcrypt.hash(user.password, 10, function (err, hash) {
          if (err) return next(err);
  
          user.password = hash;
          next();
      }); 
  });
  
  module.exports = mongoose.model('User', userSchema);
  </code></pre>
  
  <h3>nation.js</h3>
  
  <pre><code>var mongoose = require('mongoose');
  var Schema = mongoose.Schema;
  
  var Nation = new Schema({
      name: {
          type: String,
          required: true
      },
      creationDate: {
          type: Date,
          default: Date.now
      },
      user: {
          type: Schema.Types.ObjectId,
          ref: 'User'
      }
  });
  
  module.exports = mongoose.model('Nation', Nation);
  </code></pre>