is my stack secure on mongodb if i use mongos out-of-box username/password and roles for generating tokens, and I do not personally attempt to come up with a salt+hash for usernames & passwords (by having a combination of local DB salts, external AWS salts, and hard-coded end-point salts)?
The stack: I am hosted on AWS with a pem file that allows SSH access.
My security groups only allow SSH from my ip address.
I have a load balancer that uses SSL and points to nginx, which points to node. Node forces all http traffic to redirect to https. and my database is mongo.
mongo does not require a username or password to query data.
the load balancer allows all HTTP and HTTPS traffic in and out. the EC2 only allows HTTP and HTTPS in from the loadbalancer.
I have public API end-points where I generate a token via login with a correct username & password.
I do not store the users password in the database, instead I hash using
crypto.createHmac('sha512', server_salt + user_salt)
where the user salt could be guessed by a combination of the users information in the database plus a hard coded string in my js script, but the server salt is not located in my database. it is located in an amazon service repo.
The database I have which houses active tokens for users does not expose the userID for each token, but instead again has a one-way hash. tokens expire every 24 hours. (If I performed collection level access restriction, then i would expose which user-id mapped to each token, but the collection would be restricted to only be accessed by the user him/herself, so it should be safe?)
token strings are generated on login using:
If a token is not valid for a user, i return 401.
If a user tries to access user information that does not belong to him I return 403.
Tokens expire every 24 hours, using mongos expireAfterSeconds https://docs.mongodb.com/manual/tutorial/expire-data/