title: Removing Attribute from JavaScript Object, Returned by Mongoose's "findOneAndUpdate" Method
body: <p>I'm writing a simple server in JavaScript on Node.js, which (among other things) allows the user to manage their account (basic CRUD functionality, etc). The server is connected to a MongoDB instance, using Mongoose to manage the connection and data.</p>
  
  <p>Models in Mongoose have a method called <code>findOneAndUpdate()</code>, which does exactly what you think it does: queries the database for the first document returned and updates said document based on parameters you passed. It then returns the new, updated document to the user. It works exactly as intended and I have no problem with it.</p>
  
  <p>However, I don't want ALL of the user data returned. Specifically, I'd like to omit the <code>_id</code> and <code>password</code> fields. Since the object returned by MongoDB is a basic JavaScript object, I assumed that I'd be able to remove those attributes by calling <code>delete object.attribute</code>. Unfortunately, for some reason that's not working.</p>
  
  <p>Here's my code that updates the user information:</p>
  
  <pre><code>case "update":
    User.findOneAndUpdate({"token": header.token}, body, function(err, user) {
      if (err) {
        return callback(err);
      } else {
        delete user["_id"];
        delete user["password"];
        return callback(null, new SuccessEnvelope(user));
      }
    });
    break;
  </code></pre>
  
  <p>For clarity, an <code>Envelope</code> (in this case, a <code>SuccessEnvelope</code>) is a bundle of information that the client and server need in order to facilitate communication. Similar-ish to a TCP packet. Anyhow, I digress...</p>
  
  <p>For example, if I wanted to update my username from "joe_bob" to "jim_bob", I'd send this to the server:</p>
  
  <p><code>{"header": "type": "user", "method": "update", "token": "IM_A_TOKEN_GAIS_SRSLY"}, "body": {"username": "jim_bob"}}</code></p>
  
  <p>And while the user's username is updated successfully, this is what I get in return:</p>
  
  <p><code>{"header": {"type": "success"}, "body": {"__v": 0, "_id":"SOME_NUMERICAL_ID", "email": "joe_bob@email.com", "password": "SUPER_SECURE_PASSWORD_HASH_COME_AT_ME_NSA", "token": "IM_A_TOKEN_GAIS_SRSLY", "username": "jim_bob"}}</code></p>
  
  <p>As you can see, <code>_id</code> and <code>password</code> are still there. What am I doing wrong? Any help would be greatly appreciated.</p>
  
  <p>Thank you!</p>