Given an application backed by a MongoDB database. Documents that are generated via the backend are assigned a BSON ObjectIDs (a hex string) to identify them, unlike SQL like IDs which are usually natural integers starting from 1. Those IDs are not as safe as UUIDs (for example when pausing artificially the time such as in specs, two MongoIDs can be "sequential") but in a production environment where the time isn't frozen, it's doing better (how better is part of my question)

My question is : to what extent are the IDs generated by MongoDB "safe enough" for use in production (and by safe I mean confidentiality and all the security stuff)?

For example, assume some users are uploading files on the website (for instance in a conversation), and the said file are put on Amazon S3 and identified by a MongoID. How safe is it to make this file available to the public for convenient retrieval ? I understand the safest solution would be to have the backend generate a temporary secure URL, but I can't think of a reasonable scenario where a malicious person could create a hack to find these MongoIDs. The worst case scenario of an attacker that would successfully be able to download the DB is probably too "worse" to even consider this type of problem specifically.

2 Answers 2


Here's how the MongoDB id is generated: https://docs.mongodb.com/manual/reference/method/ObjectId/

The important bit is:

a 4-byte value representing the seconds since the Unix epoch,
a 5-byte random value, and
a 3-byte counter, starting with a random value.

The seconds since epoch is of course predictable, though there are many, many values to iterate through if you wanted to guess it. That leaves the 5 byte random value and the 3 byte counter to predict. That would take a bit of brute forcing, but it's not impossible.

The easiest solution may be to require user login before gaining access to the files. If that's not possible for some reason, and the files are low value, I wouldn't worry about it, it's likely good enough. If you want to be extra secure, a short lived generated random URL would be much more secure.


A black box security audit from Conix has confirmed that MongoIDs are not random enough to provide good security.

In the graph below titles translated in english

  • "Niveau d'entropie bit par bit" = "Entropy level bit per bit"
  • "Spectral analysis on ~100 IDs"

enter image description here

In the security audit this was flagged with a yellow color (average priority and potential impact, low realism)

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .