Custom Validator does not work on checking empty password
You don't store the plaintext password in mongoDB, so you can't be enforcing your password length policy as part of UserSchema validation. You need to do it before you get to the hashing/mongoose side of things. Something like this for example:
app.post("/user", function(req, res, next) { var pw = req.body.password; if (!pw || pw.length > max || pw.length < min) { return res.status(400).send('Password is required and must be > x and < y...'); } // hash the password asynchronously // ...});However, you do seem to be reinventing the wheel here. Username/password login has already been done many times over. Relying on an existing widely depended upon implementation is probably a better idea than trying to roll your own. For example: