Why should you care?

An open mongod on the internet without auth will be ransomed. Every environment beyond a locked laptop needs authentication.

See it live — copy this example

Open mongosh or MongoDB Compass, select database nosqlverse, then run the example. Change one field and run again.

use admin
db.createUser({
  user: "appUser",
  pwd: "changeMe-strong",
  roles: [ { role: "readWrite", db: "NoSQLVerse" } ]
})
// Connect:
// mongosh "mongodb://appUser:changeMe-strong@localhost:27017/NoSQLVerse?authSource=admin"
db.runCommand({ connectionStatus: 1 })

Run Example »

Edit the code below and click Run to see the result in Toolliyo’s live editor.

What happened?

• createUser defines appUser with readWrite on your database only.
• authSource=admin tells the client where credentials live.
• connectionStatus shows the authenticated user.
• Restart mongod with --auth for enforcement on self-managed installs.

Practice next

1. Create a least-privilege user for your database.
2. Connect with that user and try writing.
3. Try dropping admin — should fail.
4. Create a read-only reporter user.
5. Rotate the appUser password and update the URI.

Remember

Authentication verifies identity. Create per-app users with limited roles. Always enable auth outside local toys.

Separate app vs admin creds

Node API uses appUser; humans use SSO into Atlas with MFA.

Outcome: Leaked app password cannot drop the whole cluster as easily.