using findOne() with an undefined value returns the first document and not an error

[mansona]

The code I'm using is:

LoginModel.findOne({'fbLogin.userID' : req.body.id}, function(err, doc){
//Here err is null and doc is the first (and only) object in the collection used by the LoginModel.
});

Please note that req.body.id is undefined.

I would expect this to thow an error. I tried the same thing using the mongo client and I get the following error:

db.logins.find({'fbLogin.userId': undefined})
error: { "$err" : "can't have undefined in a query expression", "code" : 13629 }

This seems like an inconsistency between mongo and mongoose.

[aheckmann]

the -native driver casts undefined to null before sending the query. basically you have a doc with 'fbLogin.userid' set to null so it finds a match. to prevent this behavior add a check before running the query. long term you might open a ticket with node-mongodb-native.

[lexeek]

Where is this behavior described? I faced with this error too.

[marek-ciazynski]

I've also faced the same problem, it's very dangerous. I was writing authentication for my application and by mistake I was looking for undefined value in findOne which caused that some user got data from another person.