Why whitelist filter fields?
If users can set arbitrary filter fields, they can probe your data model. Whitelist the fields they can filter by (role, gender, status) and ignore the rest. Prevents query injection and limits the surface.
Verify This Answer
Cross-check this information using these trusted sources:
More FAQs in Data Sanitization Checklist for Node.js APIs
Strip $ and . with express-mongo-sanitize, strip HTML with xss-clean, trim and normalize with Zod, validate types and constraints, use runValidators on updates, whitelist filter fields, cap body size, remove duplicate query params with hpp, cast explicitly, avoid $where, set security headers with helmet, use httpOnly cookies, and rate limit auth routes.
Use express-mongo-sanitize to strip $ and . from req.body, req.params, and req.query. Validate types with Zod (objects where strings are expected are rejected). Use Mongoose (casts based on schema). Cast inputs explicitly with String(). Avoid $where.
Strip HTML from input with xss-clean or dompurify. Escape output on render (React does this by default). Set a Content Security Policy with helmet. Use httpOnly cookies so scripts cannot steal tokens. Sanitize rich text on render.
Still have questions?
Browse all our FAQs or reach out to our support team