diff --git a/services/document-updater/app.coffee b/services/document-updater/app.coffee
index cb50471965..8e14d79718 100644
--- a/services/document-updater/app.coffee
+++ b/services/document-updater/app.coffee
@@ -27,6 +27,18 @@ app.configure ->
 
 DispatchManager.createAndStartDispatchers(Settings.dispatcherCount || 10)
 
+app.param 'project_id', (req, res, next, project_id) ->
+	if project_id?.match /^[0-9a-f]{24}$/
+		next()
+	else
+		next new Error("invalid project id")
+
+app.param 'doc_id', (req, res, next, doc_id) ->
+	if doc_id?.match /^[0-9a-f]{24}$/
+		next()
+	else
+		next new Error("invalid doc id")
+
 app.get    '/project/:project_id/doc/:doc_id',       HttpController.getDoc
 app.post   '/project/:project_id/doc/:doc_id',       HttpController.setDoc
 app.post   '/project/:project_id/doc/:doc_id/flush', HttpController.flushDocIfLoaded