Hidden/Disabled fields disappear from req.body (Express JS bodyParser)

Question

I have not been able to find the answer to this question. When using NodeJS, Express, and the Express Bodyparser - and the rest of my MEAN stack for that matter - I run into an issue with both hidden and disabled fields: they do not show up in the req.body object when submitting a form.

If I understand correctly, the bodyparser aspect of express is actually taken from another project. Regardless, I have not really been able to figure out why these fields are being removed or how to stop this from happening. I suspect it might have something to do with methodoverride, but enabling/disabling this has no effect on the fields in question.

So.. for myself and future googler's: what is happening here?

Here's some code, as requested: JADE:

form(action="/admin/users/edit", method="post", ng-submit='registerUser($event)', name='form', novalidate)
    .row(ng-show="ifweareupdating")
        label(for="_id") _id:
        input(type="hidden", id="_id", name="_id", ng-model="newUser._id")
        input(type="text", id="_notHiddenId', name="_notHiddenId", ng-model="newUser._id")

EXPRESS:

app.post("/admin/users/edit", pass.ensureAdmin, userRoutes.editUserPost);

userRoutes:

exports.userRoutes.editUserPost = function(req,res,next) { 
    console.log(req.body._id) // logs undefined
    console.log(req.body._notHiddenId) // logs actual id
}

Answer 1

This has nothing to do with Express. Only successful controls are serialized and sent by the browser when a form is submitted.

The HTML spec defines what makes a control successful.

A successful control is "valid" for submission. Every successful control has its control name paired with its current value as part of the submitted form data set. A successful control must be defined within a FORM element and must have a control name.

However:

• Controls that are disabled cannot be successful.
• If a form contains more than one submit button, only the activated submit button is successful.
• All "on" checkboxes may be successful.
• For radio buttons that share the same value of the name attribute, only the "on" radio button may be successful.
• For menus, the control name is provided by a SELECT element and values are provided by OPTION elements. Only selected options may be successful. When no options are selected, the control is not successful and neither the name nor any values are submitted to the server when the form is submitted.
• The current value of a file select is a list of one or more file names. Upon submission of the form, the contents of each file are submitted with the rest of the form data. The file contents are packaged according to the form's content type.
• The current value of an object control is determined by the object's implementation.

If a control doesn't have a current value when the form is submitted, user agents are not required to treat it as a successful control.

Furthermore, user agents should not consider the following controls successful:

• Reset buttons.
• OBJECT elements whose declare attribute has been set.

Hidden controls and controls that are not rendered because of style sheet settings may still be successful.

Your problem is actually Angular. Apparently , it does not set the value of hidden inputs.