Reliability: Missing next() call in Mongoose pre-save middleware hook can cause middleware chain interruption

[anshul23102]

Problem

Mongoose pre-save hook (line 22 of User.js) returns early without calling next() when password isn't modified. This can cause middleware chain issues.

---

Technical Details

File: backend/models/User.js
Line: 22

UserSchema.pre('save', async function () {
  if (!this.isModified('password')) return;  // Early return without next()
  
  const salt = await bcrypt.genSalt(10);
  this.password = await bcrypt.hash(this.password, salt);
  // Missing: next() call after hashing
});

Issues

1. Early return without next() (though Mongoose auto-calls in async hooks)
2. No error handling if bcrypt fails
3. No try-catch for hash operation

---

Recommended Solution

Explicit next() calls and error handling:

UserSchema.pre('save', async function (next) {
  try {
    // Only hash if password is modified
    if (!this.isModified('password')) {
      return next();
    }
    
    // Hash password with salt
    const salt = await bcrypt.genSalt(10);
    this.password = await bcrypt.hash(this.password, salt);
    
    // Explicitly call next
    next();
  } catch (err) {
    // Pass error to next middleware
    next(err);
  }
});

Alternative: Using async pattern without next()

UserSchema.pre('save', async function (next) {
  if (!this.isModified('password')) {
    return next();
  }
  
  try {
    this.password = await bcrypt.hash(this.password, 10);
  } catch (err) {
    throw err;  // Let Mongoose handle
  }
});

---

Testing Strategy

• Test: Password hashed on save
• Test: Unmodified password skipped
• Test: Hashing errors handled gracefully
• Test: Middleware chain completes successfully

---

Program Template

• GSSoC '26

---

Suggested Labels

reliability, middleware, mongoose, gssoc-eligible

[anshul23102]

@GitMetricsLab

Contributing under GSSoC '26. This improves middleware reliability by explicitly calling next() and adding error handling to pre-save hooks.

Request assignment under GSSoC '26. ✅