When does Mongoose validation run?
On .save() and Model.create() by default. It does not run on findByIdAndUpdate, updateOne, or updateMany unless you pass { runValidators: true }. Always pass this option when updating through these methods.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Mongoose Validation and Custom Validators Explained
required, min, max (for numbers), minlength, maxlength (for strings), enum (value must be in the list), and match (value must match a regex). Use them at the schema level to prevent bad data at write time.
Use the validate property with a validator function and a message. The function returns true or false (or a promise). The message can be a string or a function that receives props. Example: validate: { validator: v => /^\+?\d{10,15}$/.test(v), message: 'Invalid phone' }.
Use both. Zod at the middleware layer is the primary check and returns clean 400 errors. Mongoose validation is a backup that catches anything middleware missed. Defense in depth.
Still have questions?
Browse all our FAQs or reach out to our support team