Restrict user's access to other users' documents without middleware

Hi Elias

MongoDB users are primarily targeted to reflect “system users” (eg. the identity of the driver instance in an application connecting to the DB, or the identity of a DBA ops person). rather than application “end users”. For those latter types of use cases, MongoDB Realm is specifically designed to target this: https://docs.mongodb.com/realm/mongodb/

With that said I have seen the need to drive Views based on the specific “system user” connecting and there is currently an enhancement request open for this which you can upvote: https://feedback.mongodb.com/forums/924280-database/suggestions/40642771-allow-views-with-programmatic-role-based-access-co

Some related useful info if you’ve not yet seen it: https://www.practical-mongodb-aggregations.com/examples/securing-data/restricted-view.html

HTH

Paul

1 Like