OK, 2nd theory: While req
is a normal javascript object, req.user
is a mongoose.js model instance. Mongoose has a few magical features, namely virtual properties and transforms during toObject
and toJSON
. I suspect maybe req.user.userInfo
is a mongoose virtual, which is why modifications to it get ignored because mongoose regenerates the value every time req.user.userInfo
is accessed.
If that is true (my evidence is the __v
property indicating mongoose, you can solve it by doing this:
// Splice in _id
var userInfo = req.user.userInfo;
userInfo._id = req.user._id;
console.log('newUser', req.user, userInfo);
return res.json(userInfo);
And to your larger question, the req
object is not read-only. There's some simpler bug going on in your code.
Aside: _id
is a valid identifier so you should just use normal dot syntax, but square bracket syntax is equivalent.