MongoDB Security | Authentication & Role-Based Access

# CHAPTER 22

MongoDB Security Best Practices #

1. Introduction #

*(Note: If you use MongoDB Atlas, these security features are enabled automatically by default).*

2. Learning Objectives #

• Understand the catastrophic danger of an unauthenticated database.

• Create a global Database Administrator (Superuser).

• Enable Authorization in the mongod.conf configuration file.

• Implement Role-Based Access Control (RBAC).

• Create a restricted application user following the Principle of Least Privilege.

3. Step 1: Creating the Superuser (Before Locking the Door) #

Open mongosh (currently unauthenticated):

// Switch to the special administrative database
use admin

// Create the global superuser
db.createUser({
  user: "global_admin",
  pwd: "SuperSecretPassword123!",
  roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
})

4. Step 2: Enabling Authentication (mongod.conf) #

Find the security section, uncomment it, and enable authorization:

security:
  authorization: "enabled"

*You MUST restart the MongoDB server service for this to take effect! (e.g., sudo systemctl restart mongod).*

Now, if you type mongosh and try to run show dbs, MongoDB will throw an error. You must authenticate! mongosh -u globaladmin -p --authenticationDatabase admin

We must create a restricted user for the web application using RBAC.

The Principle of Least Privilege: A user should only be given the absolute minimum permissions necessary to do their job. Nothing more.

// Switch to the specific application database
use ecommerce_db

// Create a restricted user for the web application
db.createUser({
  user: "webapp_user",
  pwd: "WebAppPassword99!",
  roles: [ 
      // This role allows reading and writing data in ecommerce_db ONLY.
      // They CANNOT drop the database, and they CANNOT read the admin database!
      { role: "readWrite", db: "ecommerce_db" } 
  ]
})

6. Read-Only Roles #

db.createUser({
  user: "analyst_sarah",
  pwd: "SarahPassword55",
  roles: [ { role: "read", db: "ecommerce_db" } ]
})
// If Sarah tries to run an updateOne() command, MongoDB will throw a fatal Permission Denied error!

7. Network Security: The Bind IP #

If your Node.js application is on Server A, and MongoDB is on Server B, you must change bindIp to include Server B's private IP address. NEVER set bindIp: 0.0.0.0 unless you have highly advanced enterprise hardware firewalls in place.

8. Mini Project: The Secure Architecture #

1. 1. The DBA (You): Logs in as globalAdmin (Role: root). Full power.

1. 2. The Main Website (Node.js): Connects as webclient (Role: readWrite on publicdb).

1. 3. The Accounting Microservice (PHP): Connects as billingservice (Role: readWrite on financedb).

1. 4. The Audit Team: Connects as auditor (Role: read on financedb).

*(Notice how the Main Website cannot physically access the financedb!)*

9. Common Mistakes #

• Ignoring Security on Localhost: Developers often leave Auth disabled locally because "it's just on my laptop." But if you accidentally run a malicious script you downloaded from NPM, it has full unauthenticated access to wipe your local databases. Always develop with Auth enabled to mirror production environments.

10. Best Practices #

• NoSQL Injection Prevention: Unlike SQL, MongoDB does not use string concatenation for queries, making traditional SQL Injection impossible. However, hackers can pass nested objects in JSON payloads (e.g., {"$ne": null}). Your backend code (PHP/Node.js) MUST sanitize incoming user input and strip out dollar signs ($) before passing data to MongoDB.

11. Exercises #

1. 1. What file must be edited to permanently enable Authorization on a self-hosted MongoDB server?

1. 2. What built-in role provides permission to execute find(), insertOne(), and updateOne(), but blocks the ability to manage database users?

12. MongoDB Challenges #

db.createUser({
  user: "backup_service",
  pwd: "SecureBackupKey!",
  roles: [ { role: "backup", db: "admin" } ]
})

13. MCQ Quiz with Answers #

14. Interview Questions #

• Q: Explain the mechanical steps required to secure a fresh, unauthenticated installation of MongoDB on a Linux server.

• Q: Describe how a NoSQL Injection attack differs from a traditional SQL Injection attack, and explain how a backend developer can neutralize it.

15. FAQs #

16. Summary #

17. Next Chapter Recommendation #