MongoDB Security with AI Prompts

Find and fix NoSQL injection vulnerabilities in my MongoDB code.

Language: Node.js with Mongoose/Native driver

Dangerous patterns to find:

1. Using user input directly in $where clauses
2. Passing unsanitized objects to find/update
3. User input in $regex without escaping
4. req.body passed directly to queries

Example vulnerable code: db.users.find({ username: req.body.username }) // Attacker sends: { "$gt": "" } to match all users

Fix by:

1. Validating input types strictly
2. Using schema validation
3. Sanitizing query operators
4. Using mongo-sanitize or similar

Show before/after for each vulnerability found.

Help me enable and configure MongoDB authentication.

Current state: No auth/Basic auth/Need to improve Deployment: Self-hosted/Docker/MongoDB Atlas

Set up:

1. Enable authentication in mongod.conf
2. Create admin user with proper roles
3. Create application-specific user (least privilege)
4. Create read-only user for reporting
5. Update connection strings with credentials

For each user, assign minimal roles:

• read, readWrite for app users
• dbAdmin for schema management
• userAdmin for user management

Show connection string format with authentication. Include steps to test auth is working correctly.

Configure role-based access control for MongoDB.

My application needs:

• App user: read/write to app database only
• Analytics: read-only access to specific collections
• Admin: full access for maintenance
• Backup user: read all databases for backups

Create:

1. Custom roles with specific privileges
2. Users assigned to each role
3. Collection-level access where needed

Example custom role needed:

• Can read from orders collection
• Can read/write to reports collection
• Cannot access users collection

Show how to:

• Create custom roles
• Assign collection-level privileges
• Test role permissions
• Audit current user permissions

Secure my MongoDB network configuration.

Current issues:

• Bound to 0.0.0.0 (all interfaces)
• No TLS configured
• Default port 27017

Help me:

1. Bind to specific interfaces only
2. Enable TLS/SSL for connections
3. Configure IP allowlist
4. Set up replica set encryption (if applicable)

For self-hosted:

• Generate and configure TLS certificates
• Update mongod.conf for security
• Configure firewall rules

For Atlas:

• Configure IP Access List
• Enable network peering if needed
• Review cluster security settings

Show mongod.conf changes and connection string updates.