Information Security Stack Exchange is a question and answer site for information security professionals. It's 100% free, no registration required.

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

According to the documentation at

The driver then runs the authenticate command for the database on which to authenticate. The authenticate command has the following syntax:

db.runCommand( { authenticate : 1, user : <username>, nonce : <nonce>, key : <digest> }

<username> is a username in the database’s system.users collection.

<nonce> is the nonce returned from a previous getnonce step.

<digest> is the hex encoding of an MD5 message digest.

The MD5 message digest is the MD5 hash of the concatenation of <nonce>, <username>, <password_digest>.

The <password_digest> is the value in the pwd field associated with the <username> in the database's system.users collection. The pwd is the hex encoding of MD5( <username> + ":mongo:" + <password_text> ).

This means that the hashing is actually done client-side, as the driver is part of the client for the database connection. In order to authenticate, the client does not need to demonstrate knowledge of the password but of the stored hash. So, the real password is the stored hash, which just happens to have been generated through hashing something. That real password is stored in plaintext in the pwd field of system.users.

Am I reading that wrong? Is there a way to secure this authentication?

share|improve this question

In a sense, that can be considered correct.

From what I understood from the MongoDB documentation, the db.addUser() expects one to pass in an already hashed password. This is clearly seen from the documentation of the function, where the expected data type of the pwd field is hash.

I read this as MongoDB expecting the system to perform the hashing prior to registration or authentication of users in the database. This makes sense when you consider that the MongoDB user most likely isn't going to be typing the password hash by hand. The use case for these user accounts are as authentication credentials for applications so the passwords are most certainly going to be stored in a configuration file somewhere.

The enterprise version of MongoDB supports the use of Kerberos for authentication. The steps to setup Kerberos can be found in the documentations as well. If you are really worried about this as a security factor, you should look into setting up Kerberos.

share|improve this answer
Minor nitpick. Kerberos is only supported in the enterprise (i.e. paid) version of MongoDB. – Justin Case Jul 14 '13 at 16:15

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.