Why whitelist filter and sort fields?
To prevent query injection (users setting arbitrary filter fields to probe your data) and errors (users sorting by a field that does not exist). Whitelisting limits the surface and keeps the API predictable.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Filtering and Sorting in Node.js APIs: A Complete Guide
Use query params. Build a filter object based on which params are present. Whitelist the fields users can filter by to prevent query injection. Pass the filter to Model.find(filter).
Use sortBy and order query params. Whitelist sortable fields to prevent errors and abuse. const sortBy = allowedSorts.includes(req.query.sortBy) ? req.query.sortBy : 'createdAt'. Use .sort({ [sortBy]: order }).
Build a filter, sort, and select from query params. Then User.find(filter).sort(sort).skip(skip).limit(limit).select(select).lean(). Run find and countDocuments in parallel with Promise.all. Return { data, total, skip, limit }.
Still have questions?
Browse all our FAQs or reach out to our support team