Will there be any security issues when storing mongodb document id in the javascript global variable?
0
I am working on a project where I need to store the document id in the javascript global variable and update the id. Although it is not exposed in the URL but I am a bit worried whether if someone opens the source code and get the document ID and performs something malicious. Is it safe to do what I am doing ?.
javascript mongodb
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
add a comment |
0
I am working on a project where I need to store the document id in the javascript global variable and update the id. Although it is not exposed in the URL but I am a bit worried whether if someone opens the source code and get the document ID and performs something malicious. Is it safe to do what I am doing ?.
javascript mongodb
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
1
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
1
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
2
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate theObjectIdvalue from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.
– Neil Lunn
Nov 22 '18 at 3:17
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18
add a comment |
0
0
0
I am working on a project where I need to store the document id in the javascript global variable and update the id. Although it is not exposed in the URL but I am a bit worried whether if someone opens the source code and get the document ID and performs something malicious. Is it safe to do what I am doing ?.
javascript mongodb
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
I am working on a project where I need to store the document id in the javascript global variable and update the id. Although it is not exposed in the URL but I am a bit worried whether if someone opens the source code and get the document ID and performs something malicious. Is it safe to do what I am doing ?.
javascript mongodb
javascript mongodb
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
asked Nov 21 '18 at 20:59
fear_matrixfear_matrix
1,98863249
1,98863249
1
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
1
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
2
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate theObjectIdvalue from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.
– Neil Lunn
Nov 22 '18 at 3:17
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18
add a comment |
1
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
1
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
2
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate theObjectIdvalue from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.
– Neil Lunn
Nov 22 '18 at 3:17
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18
1
1
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
1
1
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
2
2
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate the
ObjectId value from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.– Neil Lunn
Nov 22 '18 at 3:17
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate the
ObjectId value from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.– Neil Lunn
Nov 22 '18 at 3:17
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function () {
StackExchange.using("externalEditor", function () {
StackExchange.using("snippets", function () {
StackExchange.snippets.init();
});
});
}, "code-snippets");
StackExchange.ready(function() {
var channelOptions = {
tags: "".split(" "),
id: "1"
};
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function() {
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled) {
StackExchange.using("snippets", function() {
createEditor();
});
}
else {
createEditor();
}
});
function createEditor() {
StackExchange.prepareEditor({
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader: {
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
},
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
});
}
});
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53420399%2fwill-there-be-any-security-issues-when-storing-mongodb-document-id-in-the-javasc%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
draft saved
draft discarded
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Some of your past answers have not been well-received, and you're in danger of being blocked from answering.
Please pay close attention to the following guidance:
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
draft saved
draft discarded
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function () {
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53420399%2fwill-there-be-any-security-issues-when-storing-mongodb-document-id-in-the-javasc%23new-answer', 'question_page');
}
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function () {
StackExchange.helpers.onClickDraftSave('#login-link');
});
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
1
Client side code should never be able to directly update something in your database.
– Devon
Nov 21 '18 at 21:04
1
How would they be able to do something to it in the db from the client?
– epascarello
Nov 21 '18 at 21:06
2
It could give away details about your application's internal structure, but it should not be a security issue. An actual security issue would be when anyone could access your database (with or without document ids, that doesn't matter).
– Bergi
Nov 21 '18 at 21:16
It's actually kind of an epidemic here that we do get a lot of questions where people posting them remove or obfuscate the
ObjectIdvalue from sample documents in a question. I think what scares people are the two lines "a 3-byte machine identifier, a 2-byte process id,". So much so that current documentation does not actually say that anymore and says "5-byte random value". But the possibility that anyone could use that data for a "hacking exploit" is pretty infinitesimal.– Neil Lunn
Nov 22 '18 at 3:17
Moreover those 5-bytes have actually changed.. So in most driver implementations those bytes truly are random, and nothing about the machine or process anymore.
– Neil Lunn
Nov 22 '18 at 3:18