How do you prevent NoSQL injection?
Model answer
If you pass req.body straight into a query ({ email: req.body.email }), a client can send an object like { "$ne": null } and bypass checks. Validate that values are the expected type (strings), use a schema validator, enable Mongoose strictQuery, and consider sanitising keys that start with $ or contain dots.
Learn this topic
Connect Express to MongoDB with Mongoose in the course MERN Stack Full Course: MongoDB, Express, React and Node.js.
Sign in to add your own answer.