The answer
Use a fields query param. const fields = req.query.fields ? req.query.fields.split(',').join(' ') : null. Then .select(fields). Whitelist selectable fields to prevent exposing sensitive data like passwordHash.
Filtering and Sorting in Node.js APIs: A Complete Guide
How do I let clients select specific fields in a Node.js API?
More FAQs in Filtering and Sorting in Node.js APIs: A Complete Guide
Use query params. Build a filter object based on which params are present. Whitelist the fields users can filter by to prevent query injection. Pass the filter to Model.find(filter).
Use sortBy and order query params. Whitelist sortable fields to prevent errors and abuse. const sortBy = allowedSorts.includes(req.query.sortBy) ? req.query.sortBy : 'createdAt'. Use .sort({ [sortBy]: order }).
To prevent query injection (users setting arbitrary filter fields to probe your data) and errors (users sorting by a field that does not exist). Whitelisting limits the surface and keeps the API predictable.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.