206

When sending a request to /customers/41224d776a326fb40f000001 and a document with _id 41224d776a326fb40f000001 does not exist, doc is null and I'm returning a 404:

  Controller.prototype.show = function(id, res) {
    this.model.findById(id, function(err, doc) {
      if (err) {
        throw err;
      }
      if (!doc) {
        res.send(404);
      }
      return res.send(doc);
    });
  };

However, when _id does not match what Mongoose expects as "format" (I suppose) for example with GET /customers/foo a strange error is returned:

CastError: Cast to ObjectId failed for value "foo" at path "_id".

So what's this error?

0

32 Answers 32

265

Mongoose's findById method casts the id parameter to the type of the model's _id field so that it can properly query for the matching doc. This is an ObjectId but "foo" is not a valid ObjectId so the cast fails.

This doesn't happen with 41224d776a326fb40f000001 because that string is a valid ObjectId.

One way to resolve this is to add a check prior to your findById call to see if id is a valid ObjectId or not like so:

if (id.match(/^[0-9a-fA-F]{24}$/)) {
    // Yes, it's a valid ObjectId, proceed with `findById` call.
}
10
  • 7
    @Gremo You only get to pick one type to use for _id in your Mongoose schema. In the "bla" case you would use a type of String instead of the default ObjectId and you wouldn't need to add this check as anything can be cast to a string.
    – JohnnyHK
    Feb 18, 2013 at 17:50
  • 3
    I understand, but I'd like to avoid this check. How can I create a new ObjectId from a given string (from the GET request) for passing it to the findById method?
    – gremo
    Feb 18, 2013 at 17:58
  • 1
    @Gremo You can't. You can only construct ObjectIds from 24 hex character strings.
    – JohnnyHK
    Feb 18, 2013 at 18:24
  • 2
    You can just use find({_id: yourId},...) to query for the document with that (unique) id. That, and JohnnyHK's answer to add _id to your schema (with your desired 'string' type) is the full solution to your problem. Jan 3, 2014 at 21:26
  • 3
    These days, 12 character strings can also be cast to an ObjectId. ObjectId("000000000000") --> 303030303030303030303030
    – Dan Ross
    Oct 15, 2016 at 10:24
87

Use existing functions for checking ObjectID.

var mongoose = require('mongoose');
mongoose.Types.ObjectId.isValid('your id here');
2
  • 26
    Careful using that method as it has the curious behavior of treating any 12-byte string as valid. So it even returns true for your 'your id here' example. github.com/mongodb/js-bson/issues/106
    – JohnnyHK
    Feb 8, 2015 at 15:31
  • console.log("here"); let i = new mongoose.Types.ObjectId(userId.id); console.log("now here"); // this console not even printing Jan 22, 2018 at 15:42
43

I had to move my routes on top of other routes that are catching the route parameters:

// require express and express router

const express = require("express");
const router = express.Router();

// move this `/post/like` route on top

router.put("/post/like", requireSignin, like);

// keep the route with route parameter `/:postId` below regular routes

router.get("/post/:postId", singlePost);
7
  • 5
    This worked for me. I am curious to the reason behind this error. Could you please explain how moving the route below the regular routes caused the error to go away?
    – Vishwak
    Oct 4, 2019 at 13:41
  • 2
    This worked me as well. Looks like The /test/create satisfies this /test/:id with id=create. and string cannot be cast to_id.
    – kaila88
    Mar 30, 2020 at 22:02
  • 1
    @kaila88, your comment is quite logical, and the same way it is happening. Dec 7, 2020 at 7:55
  • 1
    This worked for me too, +1! It's so simple once you see it, but it was driving me nuts as the exception made me think there was something wrong with my DB doc IDs. :D Nov 5, 2021 at 5:49
  • 1
    @MuhammadMufeezAhmed it works because when you have params accepting route at top it satisfies criteria for other routes due to which request never reaches to the real route for example "/post/:postId" this route expects parameter after /post/, what if you try to enter /post/like It won't reach our written /post/like route instead it will match /post/:postid and you will see unwanted behaviour that's why always key route with parameters at bottom, so that it don't disturb regular routes I hope answers your question Aug 4, 2022 at 6:09
27

This might be a case of routes mismatch if you have two different routes like this

router.route("/order/me") //should come before the route which has been passed with params
router.route("/order/:id")

then you have to be careful putting the route that is using a param after the regular route that worked for me

4
  • Thanks @HarshVerma, this worked for my situation. I had a test route at the bottom of the file which kept returning a 500 error but after taking your advice and moving to the top of the file, it was successful. Can you explain why this happens? Apr 23, 2022 at 13:54
  • 3
    Hey @IamToobDude In this case generally what happens is that when you use the route that has param above the simple route then in that case any param you pass will get matched with that route For example /order/e5h57f here e5h57f is the id so it will match with /order/:id route in this case we dont see any problem but if the route was /order/me or /order/profile in this case also it will again match with /order/:id because while execution 'me' or 'profile' will be considered as :id in the /order/:id it just doesn't checks the usage while matching id param. Apr 23, 2022 at 16:00
  • Ahh I see that makes a lot of sense thank you for the explanation Apr 23, 2022 at 16:41
  • This helped me to solve my problem which I spent many hours for debugging without any clue. Thanks buddy
    – Anu
    Apr 9, 2023 at 14:09
24

I have the same issue I add
_id: String .in schema then it start work

2
  • a year later this saved me when using with connect-mongo
    – Ren44
    Sep 13, 2019 at 22:35
  • Thank you got stuck at a small point after working for 15 hr straight. Apr 10, 2020 at 15:37
15

Are you parsing that string as ObjectId?

Here in my application, what I do is:

ObjectId.fromString( myObjectIdString );
8
  • Yes, you should, because you're querying an ObjectId type, so the cast is needed. Feb 18, 2013 at 17:33
  • 2
    Try mongoose.Types.ObjectId. Feb 18, 2013 at 17:59
  • 1
    Works, but I get "Invalid ObjectId" when passing "foo". So what's the point of creating an ObjectId from a string, if it may fail?
    – gremo
    Feb 18, 2013 at 18:02
  • As per the MongoDB docs, ObjectIds must be 24 hexadecimal bytes only. Feb 18, 2013 at 18:07
  • 2
    fromString is not a function
    – WasiF
    Jan 30, 2019 at 8:42
12

it happens when you pass an invalid id to mongoose. so first check it before proceeding, using mongoose isValid function

import mongoose from "mongoose";

// add this inside your route
if( !mongoose.Types.ObjectId.isValid(id) ) return false;
1
  • 2022 this works. This helps my issue when the ID is not valid. Thank you
    – user6684898
    Dec 24, 2022 at 0:49
8

In my case, I had to add _id: Object into my Schema, and then everything worked fine.

7

As of Nov 19, 2019

You can use isValidObjectId(id) from mongoose version 5.7.12

https://mongoosejs.com/docs/api/mongoose.html#mongoose_Mongoose-isValidObjectId

6
 if(mongoose.Types.ObjectId.isValid(userId.id)) {
        User.findById(userId.id,function (err, doc) {
            if(err) {
                reject(err);
            } else if(doc) {
                resolve({success:true,data:doc});
            } else {
                reject({success:false,data:"no data exist for this id"})

            }
        });
        } else {
            reject({success:"false",data:"Please provide correct id"});
        }

best is to check validity

4

If above solutions do not work for you. Check if you are sending a GET request to a POST route.
It was that simple and stupid for me.

0
4

All you have to do is change the parameter name "id" to "_id"

0
3

You can also use ObjectId.isValid like the following :

if (!ObjectId.isValid(userId)) return Error({ status: 422 })
1
  • 1
    ReferenceError: ObjectId is not defined Dec 19, 2019 at 11:33
3

You could either validate every ID before using it in your queries (which I think is the best practice),

// Assuming you are using Express, this can return 404 automatically.
app.post('/resource/:id([0-9a-f]{24})', function(req, res){
  const id = req.params.id;
  // ...
});

... or you could monkey patch Mongoose to ignore those casting errors and instead use a string representation to carry on the query. Your query will of course not find anything, but that is probably what you want to have happened anyway.

import { SchemaType }  from 'mongoose';

let patched = false;

export const queryObjectIdCastErrorHandler = {
  install,
};

/**
 * Monkey patches `mongoose.SchemaType.prototype.castForQueryWrapper` to catch
 * ObjectId cast errors and return string instead so that the query can continue
 * the execution. Since failed casts will now use a string instead of ObjectId
 * your queries will not find what they are looking for and may actually find
 * something else if you happen to have a document with this id using string
 * representation. I think this is more or less how MySQL would behave if you
 * queried a document by id and sent a string instead of a number for example.
 */
function install() {
  if (patched) {
    return;
  }

  patch();

  patched = true;
}

function patch() {
  // @ts-ignore using private api.
  const original = SchemaType.prototype.castForQueryWrapper;

  // @ts-ignore using private api.
  SchemaType.prototype.castForQueryWrapper = function () {
    try {
      return original.apply(this, arguments);
    } catch (e) {
      if ((e.message as string).startsWith('Cast to ObjectId failed')) {
        return arguments[0].val;
      }

      throw e;
    }
  };
}
1
  • This was a nice solution
    – anoop4real
    Dec 31, 2023 at 11:57
2
//Use following to check if the id is a valid ObjectId?

var valid = mongoose.Types.ObjectId.isValid(req.params.id);
if(valid)
{
  //process your code here
} else {
  //the id is not a valid ObjectId
}
1
  • 1
    There are other answers that provide the OP's question, and they were posted many years ago. When posting an answer, please make sure you add either a new solution, or a substantially better explanation, especially when answering older questions. Code-only answers are considered low quality: make sure to provide an explanation what your code does and how it solves the problem. Apr 14, 2019 at 9:17
2

I was faced with something similar recently and solved it by catching the error to find out if it's a Mongoose ObjectId error.

app.get("/:userId", (req, res, next) => {
    try {
        // query and other code here
    } catch (err) {
        if (err.kind === "ObjectId") {
            return res.status(404).json({
                errors: [
                    {
                        msg: "User not found",
                        status: "404",
                    },
                ],
            });
        }
        next(err);
    }
});
2

In my case, similar routes caused this problem.

Router.get("/:id", getUserById);
Router.get("/myBookings",getMyBookings);

In above code, whenever a get request to route "/myBookings" is made, it goes to the first route where req.params.id is equals to "myBookings" which is not a valid ObjectId.

It can be corrected by making path of both routes different.

Something like this

Router.get("/user/:id", getUserById);
Router.get("/myBookings",getMyBookings);
2

The way I fix this problem is by transforming the id into a string

I like it fancy with the backtick: `${id}`

this should fix the problem with no overhead

UPDATE OCT 2022

it would be best if you now used the :

{id: id} // if you have an id property defined

or

{_id: new ObjectId(id)} // and search for the default mongodb _id
1

I went with an adaptation of the @gustavohenke solution, implementing cast ObjectId in a try-catch wrapped around the original code to leverage the failure of ObjectId casting as a validation method.

Controller.prototype.show = function(id, res) {
  try {
    var _id = mongoose.Types.ObjectId.fromString(id);



    // the original code stays the same, with _id instead of id:

    this.model.findById(_id, function(err, doc) {
      if (err) {
        throw err;
      }
      if (!doc) {
        res.send(404);
      }
      return res.send(doc);
    });



  } catch (err) {
    res.json(404, err);
  }
};
1
1

This is an old question but you can also use express-validator package to check request params

express-validator version 4 (latest):

validator = require('express-validator/check');

app.get('/show/:id', [

    validator.param('id').isMongoId().trim()

], function(req, res) {

    // validation result
    var errors = validator.validationResult(req);

    // check if there are errors
    if ( !errors.isEmpty() ) {
        return res.send('404');
    }

    // else 
    model.findById(req.params.id, function(err, doc) { 
        return res.send(doc);
    });

});

express-validator version 3:

var expressValidator = require('express-validator');
app.use(expressValidator(middlewareOptions));

app.get('/show/:id', function(req, res, next) {

    req.checkParams('id').isMongoId();

    // validation result
    req.getValidationResult().then(function(result) {

        // check if there are errors
        if ( !result.isEmpty() ) {
            return res.send('404');
        }

        // else
        model.findById(req.params.id, function(err, doc) {
            return res.send(doc);
        });

    });

});
1

Always use mongoose.Types.ObjectId('your id')for conditions in your query it will validate the id field before running your query as a result your app will not crash.

1

I was having problems with this and fixed doing mongoose.ObjectId(id) without Types

0
1

ObjectId is composed of following things.

  1. a 4-byte value representing the seconds since the Unix epoch
  2. a 5-byte random value (Machine ID 3 bytes and Processor id 2 bytes)
  3. a 3-byte counter, starting with a random value.

Correct way to validate if the objectId is valid is by using static method from ObjectId class itself.

mongoose.Types.ObjectId.isValid(sample_object_id)
1

You are having the castError because the next route you called after the id route could not be attached to the id route. You have to declare the id route as one last route.

1
  • Your answer could be improved with additional supporting information. Please edit to add further details, such as citations or documentation, so that others can confirm that your answer is correct. You can find more information on how to write good answers in the help center.
    – Community Bot
    Jun 24, 2022 at 5:13
0

OR you can do this

var ObjectId = require('mongoose').Types.ObjectId; var objId = new ObjectId( (param.length < 12) ? "123456789012" : param );

as mentioned here Mongoose's find method with $or condition does not work properly

0

Cast string to ObjectId

import mongoose from "mongoose"; // ES6 or above
const mongoose = require('mongoose'); // ES5 or below

let userid = _id
console.log(mongoose.Types.ObjectId(userid)) //5c516fae4e6a1c1cfce18d77
0

Detecting and Correcting the ObjectID Error

I stumbled into this problem when trying to delete an item using mongoose and got the same error. After looking over the return string, I found there were some extra spaces inside the returned string which caused the error for me. So, I applied a few of the answers provided here to detect the erroneous id then remove the extra spaces from the string. Here is the code that worked for me to finally resolve the issue.

const mongoose = require("mongoose");
mongoose.set('useFindAndModify', false);  //was set due to DeprecationWarning: Mongoose: `findOneAndUpdate()` and `findOneAndDelete()` without the `useFindAndModify`



app.post("/delete", function(req, res){
  let checkedItem = req.body.deleteItem;
  if (!mongoose.Types.ObjectId.isValid(checkedItem)) {
    checkedItem = checkedItem.replace(/\s/g, '');
  }

  Item.findByIdAndRemove(checkedItem, function(err) {
    if (!err) {
      console.log("Successfully Deleted " + checkedItem);
        res.redirect("/");
      }
    });
});

This worked for me and I assume if other items start to appear in the return string they can be removed in a similar way.

I hope this helps.

0

I had the same error, but in a different situation than in the question, but maybe it will be useful to someone.

The problem was adding buckles:

Wrong:

    const gamesArray = [myId];

    const player = await Player.findByIdAndUpdate(req.player._id, {
         gamesId: [gamesArray]
    }, { new: true }

Correct:

    const gamesArray = [myId];

    const player = await Player.findByIdAndUpdate(req.player._id, {
         gamesId: gamesArray
    }, { new: true }

0

In my case the parameter id length was 25, So I trimmed first character of parameter id and tried. It worked.

Blockquote

const paramId = req.params.id;
if(paramId.length === 25){
  const _id = paramId.substring(1, 25);
}

To change the string object to ObjectId instance fromString() method is not exist anymore. There is a new method createFromHexString().

const _id = mongoose.Types.ObjectId.fromString(id); // old method not available
const _id = mongoose.Types.ObjectId.createFromHexString(id); // new method.
0

could happen if you are sending less or more then 24 characters string as id

Not the answer you're looking for? Browse other questions tagged or ask your own question.