Suppose I have a web application that is a social network. In order for two people to have access to eachother's content they must become friends.
There is logic in the application to ensure both have improved eachother and once that happens, an update is made in each user's "friends" array.
I am wondering though; suppose some hacker found a way to append their user_id to another user's
friends array. Now he can view the other user's content unauthorized. For simplicity, assume that this is the only security flaw in the system.
How does one protect against this sort of possibility? Are there features in databases that handle this?
P.S. The database I happen to be using is MongoDB, but also curious to hear about others