Common Mongoose Mistakes (and How to Avoid Them)

Common Mongoose Mistakes

Mongoose is easy to start with and easy to get wrong. Here are the common mistakes and how to avoid them.

Mistake 1: No Validation on Updates

You use findByIdAndUpdate without runValidators. Validation runs only on save. Fix: pass { runValidators: true, new: true } on every update.

Mistake 2: Storing Passwords in Plain Text

You save req.body.password directly. Fix: hash with bcrypt in a pre('save') hook or in the controller. Never store raw passwords.

Mistake 3: Returning passwordHash in Responses

You do User.find() and return everything. Fix: mark passwordHash with select: false in the schema. It is excluded by default. Use .select('+passwordHash') only when needed (e.g., login).

Mistake 4: No Indexes on Hot Queries

You query by email but did not add an index. MongoDB scans every document. Fix: index the fields you query. Use explain() to verify.

Mistake 5: Embedding Unbounded Arrays

You store all messages in a connection document. The array grows until the document hits 16MB. Fix: use refs and a separate collection for large N.

Mistake 6: N+1 Queries

You loop over documents and call findById for each reference. Fix: use populate to do it in 2 queries.

Mistake 7: Not Handling Duplicate Key Errors

You create a user with a duplicate email and get a 11000 error. You send a 500 to the client. Fix: catch the error, check err.code === 11000, return 409 with a clear message.

Mistake 8: Using .find() Without a Limit

You do User.find() and return every user. Fix: always paginate. Use skip and limit, or cursor-based pagination.

Mistake 9: Forgetting .lean() for Read-Only Queries

You query a list and send it as JSON. Mongoose hydrates full documents with methods. Fix: use .lean() to get plain objects. Faster.

Mistake 10: Sync Calls in Request Handlers

You use callbacks or sync APIs in handlers. Fix: use async/await. Wrap with asyncHandler. Let errors flow to the error handler.

Mistake 11: Mixing Mongoose Validation With Business Logic

You put business logic in pre('save') hooks. Hard to test. Fix: keep validation in the schema; keep business logic in controllers or services.

Mistake 12: No timestamps

You do not use timestamps. You cannot sort by createdAt. Fix: add { timestamps: true } to the schema.

The Takeaway

Common Mongoose mistakes: no validation on updates, plain-text passwords, returning passwordHash, no indexes, embedding unbounded arrays, N+1 queries, not handling duplicate key errors, no pagination, no .lean() for read-only, sync calls, mixing validation with logic, and no timestamps. Avoid these from day one.