Using Express and Passportjs - can end users read/write req. object?

I am using Express and Passportjs for my backend to log users into my webapp via frontend. I have a few questions:1.) Can end users (a user that has logged into my webapp) read the request object? Can they read the req.user object?2.) Can end users (a user that has logged into my webapp) modify the request object? Can they modify the req.user object?A user can submit input via forms, which then can be read by the server via req.query and req.body objects, but can users read/modify any other part of the req. object?

Submitted July 16, 2020 at 06:55PM by MonkeyOnARock1