如何在REST API中公开MongoDB文档的主键？

Question

I am building a REST API with MongoDB + nodeJS. All the documents are stored and are using _id as the primary key. I've read here that we should not expose the _id and we should use another ID which is not incremental.

In the DB, a document is represented as:

{ 
   _id: ObjectId("5d2399b83e9148db977859ea")
   bookName: "My book"
}

For the following the endpoints, how should the documents be exposed?

GET /books
GET /books/{bookId}

Currently my API returns:

{ 
   _id: "5d2399b83e9148db977859ea"
   bookName: "My book"
}

but should it instead return something like:

{ 
   id: "some-unique-id-generated-on-creation"
   bookName: "My book"
}

Questions

• Should I expose the _id so that one can make queries such as:

  GET /books/5d2399b83e9148db977859ea

• Should I use a UUID for my ID instead of ObjectId?

• Should I keep the internal _id (but never expose it) and create another attribute id which would use UUID or another custom generated ID ?
• Is it a good practice to work with _id in my backend or should I only make queries using my own custom ID? Example: find({ id: }) instead of find({ _id: })

Answer 1

To answer your questions.

1. You can expose _id so that authenticated users can make queries like GET, PUT and PATCH on that _id.

2. MongoDB has support that allows you to generate your own BSON ID and use it, instead of mongodb created it's own _id during the insert.

3. There is no need of duplicating logic, the main purpose of _id is to identify each document separately and having two id columns means you are storing redundant data, follow DRY (DO NOT REPEAT YOURSELF) principle wherever possible.

4. It's not a bad practice to work with _id in your backend.

Hope this helps!

Answer 2

Given you're using Mongoose, you can use 'virtuals', which are essentially fake fields that Mongoose creates. They're not stored in the DB, they just get populated at run time:

// Duplicate the ID field.
Schema.virtual('id').get(function(){
    return this._id.toHexString();
});

// Ensure virtual fields are serialised.
Schema.set('toJSON', {
    virtuals: true
});

Any time toJSON is called on the Model you create from this Schema, it will include an 'id' field that matches the _id field Mongo generates. Likewise you can set the behaviour for toObject in the same way.

You can refer the following docs:
1) https://mongoosejs.com/docs/api.html
2) toObject method

Answer 3

In my case, whether it's a security risk or not, but my _id is a concatenation of any of the fields in my Document that are semantically considered as keys, ie if i have First Name, Last Name, and Email as my identifier, and a fourth field such as Age as attribute, then _id would be concatenation of all these 3 fields. It would not be difficult to get and update such record as long as I have First Name, Last Name and email information available