diff --git a/src/api/endpoints/following/create.js b/src/api/endpoints/following/create.js
index 90a6da983..4a796b11a 100644
--- a/src/api/endpoints/following/create.js
+++ b/src/api/endpoints/following/create.js
@@ -28,6 +28,11 @@ module.exports = (params, user) =>
 		return rej('user_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(userId)) {
+		return rej('incorrect user_id');
+	}
+
 	// 自分自身
 	if (user._id.equals(userId)) {
 		return rej('followee is yourself');
diff --git a/src/api/endpoints/following/delete.js b/src/api/endpoints/following/delete.js
index 9bb1b082e..2da20dea3 100644
--- a/src/api/endpoints/following/delete.js
+++ b/src/api/endpoints/following/delete.js
@@ -27,6 +27,11 @@ module.exports = (params, user) =>
 		return rej('user_id is required');
 	}
 
+	// Validate id
+	if (!mongo.ObjectID.isValid(userId)) {
+		return rej('incorrect user_id');
+	}
+
 	// Check if the followee is yourself
 	if (user._id.equals(userId)) {
 		return rej('followee is yourself');