Why MongoDB security matters - See It in Action

Why MongoDB Security Matters

📖 Scenario: You are managing a small online store's database using MongoDB. You want to understand why securing your MongoDB database is important to protect your customers' data and your business.

🎯 Goal: Learn the basic reasons why MongoDB security matters by creating a simple collection and adding a security-related configuration.

📋 What You'll Learn

Create a MongoDB collection named customers with sample customer data

Add a configuration variable to represent a security setting

Write a query to find customers with a specific condition

Add a final security-related setting to complete the setup

💡 Why This Matters

🌍 Real World

Securing customer data in an online store database is critical to protect privacy and prevent unauthorized access.

💼 Career

Database administrators and developers must understand MongoDB security basics to keep data safe and comply with regulations.

1

Create the customers collection with sample data

Create a MongoDB collection called customers and insert these exact documents: { name: "Alice", email: "[e-mail]" } and { name: "Bob", email: "[e-mail]" }.

MongoDB

// Insert the customers documents into the collection
// Your code here

Hint

Use db.collection.insertMany() to add multiple documents at once.

2

Add a security configuration variable

Create a variable called enableAuthentication and set it to true to represent enabling MongoDB authentication.

MongoDB

db.customers.insertMany([
  { name: "Alice", email: "[e-mail]" },
  { name: "Bob", email: "[e-mail]" }
])

// Set the authentication flag
// Your code here

Hint

Use const to declare a variable that won't change.

3

Query customers with a specific email domain

Write a query using db.customers.find() to find all customers whose email ends with @example.com.

MongoDB

db.customers.insertMany([
  { name: "Alice", email: "[e-mail]" },
  { name: "Bob", email: "[e-mail]" }
])

const enableAuthentication = true;

// Find customers with emails ending in '@example.com'
// Your code here

Hint

Use a regular expression in the query to match the email pattern.

4

Add a final security setting for access control

Add a variable called roleBasedAccessControl and set it to true to represent enabling role-based access control in MongoDB.

MongoDB

db.customers.insertMany([
  { name: "Alice", email: "[e-mail]" },
  { name: "Bob", email: "[e-mail]" }
])

const enableAuthentication = true;

const exampleCustomers = db.customers.find({ email: /@example\.com$/ });

// Enable role-based access control
// Your code here

Hint

Use a boolean variable to represent enabling role-based access control.

Practice

1. Why is it important to use authentication in MongoDB?

easy

A. To ensure only authorized users can access the database

B. To speed up database queries

C. To reduce the size of the database

D. To automatically backup data

Solution

1. Step 1: Understand authentication purpose

   Authentication verifies the identity of users trying to access the database.

2. Step 2: Connect authentication to security

   By verifying users, it prevents unauthorized access and protects data.

3. Final Answer:

   To ensure only authorized users can access the database -> Option A

4. Quick Check:

   Authentication = Authorized access [OK]

Hint: Authentication means checking who can enter [OK]

Common Mistakes:

• Confusing authentication with performance improvement
• Thinking authentication reduces database size
• Believing authentication automatically backs up data

2. Which of the following is the correct way to create a user with read-only access in MongoDB shell?

easy

A. db.createUser({user: 'reader', pwd: 'pass123', roles: ['read']})

B. db.addUser('reader', 'pass123', 'read')

C. db.createUser('reader', 'pass123', ['read'])

D. db.addUser({user: 'reader', pwd: 'pass123', roles: ['read']})

Solution

1. Step 1: Recall MongoDB user creation syntax

   The correct method is db.createUser() with an object specifying user, password, and roles.

2. Step 2: Check options for correct syntax

   db.createUser({user: 'reader', pwd: 'pass123', roles: ['read']}) uses db.createUser with proper object format; others use deprecated or incorrect syntax.

3. Final Answer:

   db.createUser({user: 'reader', pwd: 'pass123', roles: ['read']}) -> Option A

4. Quick Check:

   Use db.createUser with object format [OK]

Hint: Use db.createUser with an object for user details [OK]

Common Mistakes:

• Using deprecated db.addUser method
• Passing parameters as separate arguments instead of an object
• Incorrect roles format

3. Given the following MongoDB command:

db.createUser({user: 'admin', pwd: 'strongPass', roles: ['readWrite', 'dbAdmin']})

What does this command do?

medium

A. Creates a user with read-only access

B. Creates a user with read and write access plus admin rights on the database

C. Deletes the user named 'admin'

D. Changes the password of the user 'admin'

Solution

1. Step 1: Analyze the roles assigned

   The roles 'readWrite' and 'dbAdmin' allow reading, writing, and database administration.

2. Step 2: Understand the command effect

   The command creates a new user named 'admin' with the specified password and roles.

3. Final Answer:

   Creates a user with read and write access plus admin rights on the database -> Option B

4. Quick Check:

   Roles readWrite + dbAdmin = write and admin access [OK]

Hint: Roles define user permissions; readWrite + dbAdmin means full access [OK]

Common Mistakes:

• Thinking it creates a read-only user
• Confusing createUser with delete or update commands
• Ignoring roles and their meanings

4. You run this command in MongoDB shell:

db.createUser({user: 'guest', pwd: 'guest123', roles: 'read'})

But it returns an error. What is the problem?

medium

A. The command should be db.addUser instead

B. The password is too weak

C. The user name 'guest' is reserved

D. The roles field should be an array, not a string

Solution

1. Step 1: Check roles field format

   The roles field must be an array of strings, not a single string.

2. Step 2: Identify error cause

   Passing roles as 'read' (string) causes syntax error; it should be ['read'].

3. Final Answer:

   The roles field should be an array, not a string -> Option D

4. Quick Check:

   Roles must be an array like ['read'] [OK]

Hint: Roles always go inside square brackets [OK]

Common Mistakes:

• Using a string instead of an array for roles
• Assuming weak password causes syntax error
• Using deprecated db.addUser method

5. You want to secure your MongoDB database by limiting access only to users with strong passwords and specific roles. Which combination of steps is best practice?

hard

A. Use weak passwords but restrict IP addresses only

B. Allow anonymous access but monitor logs regularly

C. Create users with strong passwords, assign roles carefully, and enable authentication

D. Disable authentication to improve performance

Solution

1. Step 1: Identify security best practices

   Strong passwords, role-based access, and enabling authentication are key to securing MongoDB.

2. Step 2: Evaluate options against best practices

   Create users with strong passwords, assign roles carefully, and enable authentication includes all these steps; others weaken security or disable important features.

3. Final Answer:

   Create users with strong passwords, assign roles carefully, and enable authentication -> Option C

4. Quick Check:

   Strong passwords + roles + authentication = secure MongoDB [OK]

Hint: Strong passwords + roles + authentication = secure database [OK]

Common Mistakes:

• Allowing anonymous access thinking monitoring is enough
• Using weak passwords relying only on IP restrictions
• Disabling authentication to gain speed