Following users are created in mongodb. First user created with name "user" having read write role for "project" database use project
db.createUser(
{
user: "user",
pwd: "user123",
roles: [
{ role: "readWrite", db: "project" },
{ role: "readAnyDatabase", db:"admin" }
]
}
)
second user created with name "stud" having read write role for "student" database use student
db.createUser(
{
user: "stud",
pwd: "stud123",
roles: [
{ role: "readWrite", db: "stud" },
{ role: "readAnyDatabase", db:"admin" }
]
}
)
When I connected to database having name project using "user" I am getting project as well as student database and also to able to create new collection in student database. I haven't give any permission to "user" to access student database. Still it is possible to access student database. How to avoid it?