How do find queries and projections work?

Question

Accepted Answer

The **`find`** method retrieves documents matching a filter; **projection** controls which fields are returned. Together they let you query for the right documents and shape the output — fundamental for reading data efficiently.

## find — query documents

```js
db.users.find();                          // all documents
db.users.find({ age: { $gt: 25 } });      // filter: matching documents (a CURSOR)
db.users.findOne({ email: "ann@x.com" }); // the FIRST matching document (or null)

// find returns a CURSOR you can chain methods on
db.users.find({ active: true })
  .sort({ name: 1 })                      // sort
  .limit(10)                              // limit
  .skip(20);                              // skip (pagination)
```

`find` returns a **cursor** (a pointer to results) you can chain with `sort`, `limit`, `skip`, etc. `findOne` returns a single document directly.

## Projection — choose which fields to return

```js
// projection: 1 = include, 0 = exclude
db.users.find({ active: true }, { name: 1, email: 1 });        // only name and email (+ _id)
db.users.find({}, { password: 0 });                           // everything EXCEPT password
db.users.find({}, { name: 1, _id: 0 });                       // name only, exclude _id
```

**Projection** (the second argument) controls returned fields: `1` includes, `0` excludes. `_id` is included by default (exclude with `_id: 0`). You generally can't mix includes and excludes (except for `_id`).

## Why projection matters: efficiency and security

```text
✓ EFFICIENCY — return only needed fields → less data transferred (especially for large
  documents or large result sets) → faster
✓ SECURITY — EXCLUDE sensitive fields (passwords, internal data) so they don't leak
  → e.g. always project out password fields when returning user data
```

## Projecting nested and array fields

```js
db.users.find({}, { "address.city": 1 });        // nested field (dot notation)
db.posts.find({}, { comments: { $slice: 5 } });   // first 5 array elements
```

## Why it matters

`find` and projection are fundamental for **reading data** in MongoDB — querying for the right documents and shaping the output are constant needs, so understanding them is essential everyday knowledge.

Knowing how `find` works (returning a cursor of matching documents, chainable with `sort`/`limit`/`skip` for ordering and pagination) and `findOne` (a single document) is the foundation of reading data. **Projection** is particularly important for two practical reasons: **efficiency** (returning only the fields you need reduces data transferred — significant for large documents or result sets, improving performance) and especially **security** (excluding sensitive fields like passwords or internal data so they don't leak in query results — a common, important practice, e.g. always projecting out password fields when returning user data, similar to using response models in APIs).

Understanding how to include (`1`) or exclude (`0`) fields, that `_id` is included by default, and how to project nested/array fields covers the practical shaping of query results.

Since reading data is the most common database operation, and since `find` with projection is how you efficiently and securely retrieve the right documents with the right fields, understanding find queries and projections — the cursor model, chaining for sort/pagination, and especially projection for efficiency and security (excluding sensitive data) — is essential, frequently-applied MongoDB knowledge for any data-reading code, with the security aspect of projecting out sensitive fields being a particularly important practical consideration.