This question already has an answer here:

I want to know what are the best practices to secure NoSql database like MongoDB. How is it possible? Any tips?

marked as duplicate by M'vy, AJ Henderson, user10211, AviD Mar 18 '13 at 18:17

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

  • 4
    Welcome to Security.se, you question as formulated here is too broad. Could you refine your question with more details like: what did you already did, what is the architecture of your service (is it direct access to DB via internet, is it a server for an online application, ...), what data do you want to protect (user data, credit card number, ...). As is, this question is very likely to be closed. – M'vy Mar 7 '13 at 9:29
  • I want to protect user data for my application. – Ganesh Kunwar Mar 7 '13 at 10:02
  • 1
    I suggest you edit the question with the relevant details. – M'vy Mar 7 '13 at 10:03
  • I want to know tips for securing my database. – Ganesh Kunwar Mar 7 '13 at 10:06
  • Most like you should just read this: security.stackexchange.com/questions/7610/… – Reinstate Monica Mar 7 '13 at 16:38

For mongodb i have written this answer

First vulnerability similar to sql injection can be done in mongodb or nosql databases too. which would be mongodb injection.

Try to run mongodb on different port instead on default 27017 to avoid exposing. For official security practices you can always check out http://docs.mongodb.org/manual/administration/security/

It tell security practices that should be used with mongodb server.

Mongodb Injection :

its fully describes here for php how mongodb injection can take place in phpwebapp if client side data is not filtered properly. Also solution to mongodb injection too


Mongodb Null byte injection attack


This is also a type of attack that is well written on this site , Have a look how certain fields in mongo collection can be overwritten using this method can this can be done in any webapp.

  • Downvote without a reason????? – Abhishek Aug 24 '13 at 15:24
  • Security by obscurity does not exist.....changing the port does not automatically protect the database. – Matthew Xerri Nov 29 '13 at 11:48

Not the answer you're looking for? Browse other questions tagged or ask your own question.