0

I'm using mongoDB version 4.0.9 for various things. One of them is storing and retrieving files in mongoDB via GridFS. For that purpose, I have created a role/user in mongo with the privileges "createCollection", "find", "insert", and "createIndex".

However, I would like to limit the user's reading rights to only find documents by their ObjectId because this is all I need: The mentioned mongoDB user gets the ObjectIds from another data source and retrieves documents only by their id.

Right now, that user could list all documents via the find command. That means if an attacker was able to hijack that user's account, they could read everything.

If, however, there was a way to limit the user's rights to only read documents by their id then the attacker would be forced to brute force the ObjectId and that could easily be detected in the log files.

Improve this question
1
  • If your users can't be trusted and need limited access to the data, this seems like a compelling reason to provide API access rather than direct access to your MongoDB deployment. It would be easier to monitor and rate limit your user requests via an API, and less risky to expose API endpoints instead of your MongoDB deployment. If end user requests are coming directly to your MongoDB server, you will also be detecting abuse logged after the fact instead of cutting off those requests before they waste server resources.
    – Stennie
    Commented May 16, 2019 at 12:18

1 Answer 1

Reset to default
1

Currently, The lower level you can control the access of resources is at the collection level.

One option you can try is to create collections at each user level and give the user access to only that collection.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.