Security in MongoDB is relatively young in terms of features and granularity. Interestingly, they indicate that a typical use case would be to use Mongo on a trusted network “much like how one would use, say, memcached.” MongoDB does NOT run in secure mode by default. As it is, the features that are available are standard, proven and probably sufficient for most use cases. Here’s a quick summary of pros and cons. Pros Nonce-based digest for authentication Security applies across replica set nodes and shard members Cons Few recent replies on security wiki......
Continue Reading
For simplicity and security I’ve decided to integrate with the Google Account authentication mechanism that’s built into Google App Engine. This allows anyone with a Google account to login to my application without the need to setup another account. This also gives me access to the user’s valid email in order to send messages and other communication related to the service I provide. So far I have three separate ‘areas’ for interfacing with my service. The first area is comprised of public pages, such as the home page or privacy policy. The next......
Continue Reading