Single seeded user on MongoDB for logging into own website to add, edit, or delete posts
I have recently built a website for a friend to support his new business. They have a "news" section, on which he can add posts with a picture if needed. I have set up a database using Mongo which stores the title, contents, and image address of each post. I have also set up a user schema to store their login details. This is authenticated with passport.js.
The website has no availablility for registration. I have seeded the user database with only their account. When they login (using www.example.com/login), buttons appear for their session on the news page for adding new posts, delete, edit, etc. These buttons are hidden usually. We originally discussed them either sending me content to upload, or being able to edit the HTML themselves, but I wanted to make it a bit more user friendly.
Is this a bad approach, and does it open the server or database up to any vulnerabilities? Is using MongoDB suitable for commercial and public facing websites?
mongodb security
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
add a comment |
I have recently built a website for a friend to support his new business. They have a "news" section, on which he can add posts with a picture if needed. I have set up a database using Mongo which stores the title, contents, and image address of each post. I have also set up a user schema to store their login details. This is authenticated with passport.js.
The website has no availablility for registration. I have seeded the user database with only their account. When they login (using www.example.com/login), buttons appear for their session on the news page for adding new posts, delete, edit, etc. These buttons are hidden usually. We originally discussed them either sending me content to upload, or being able to edit the HTML themselves, but I wanted to make it a bit more user friendly.
Is this a bad approach, and does it open the server or database up to any vulnerabilities? Is using MongoDB suitable for commercial and public facing websites?
mongodb security
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
add a comment |
I have recently built a website for a friend to support his new business. They have a "news" section, on which he can add posts with a picture if needed. I have set up a database using Mongo which stores the title, contents, and image address of each post. I have also set up a user schema to store their login details. This is authenticated with passport.js.
The website has no availablility for registration. I have seeded the user database with only their account. When they login (using www.example.com/login), buttons appear for their session on the news page for adding new posts, delete, edit, etc. These buttons are hidden usually. We originally discussed them either sending me content to upload, or being able to edit the HTML themselves, but I wanted to make it a bit more user friendly.
Is this a bad approach, and does it open the server or database up to any vulnerabilities? Is using MongoDB suitable for commercial and public facing websites?
mongodb security
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
I have recently built a website for a friend to support his new business. They have a "news" section, on which he can add posts with a picture if needed. I have set up a database using Mongo which stores the title, contents, and image address of each post. I have also set up a user schema to store their login details. This is authenticated with passport.js.
The website has no availablility for registration. I have seeded the user database with only their account. When they login (using www.example.com/login), buttons appear for their session on the news page for adding new posts, delete, edit, etc. These buttons are hidden usually. We originally discussed them either sending me content to upload, or being able to edit the HTML themselves, but I wanted to make it a bit more user friendly.
Is this a bad approach, and does it open the server or database up to any vulnerabilities? Is using MongoDB suitable for commercial and public facing websites?
mongodb security
mongodb security
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
asked Nov 14 '18 at 9:08
default-LAdefault-LA
3517
3517
add a comment |
add a comment |
0
active
oldest
votes
Your Answer
StackExchange.ifUsing("editor", function ()
StackExchange.using("externalEditor", function ()
StackExchange.using("snippets", function ()
StackExchange.snippets.init();
);
);
, "code-snippets");
StackExchange.ready(function()
var channelOptions =
tags: "".split(" "),
id: "1"
;
initTagRenderer("".split(" "), "".split(" "), channelOptions);
StackExchange.using("externalEditor", function()
// Have to fire editor after snippets, if snippets enabled
if (StackExchange.settings.snippets.snippetsEnabled)
StackExchange.using("snippets", function()
createEditor();
);
else
createEditor();
);
function createEditor()
StackExchange.prepareEditor(
heartbeatType: 'answer',
autoActivateHeartbeat: false,
convertImagesToLinks: true,
noModals: true,
showLowRepImageUploadWarning: true,
reputationToPostImages: 10,
bindNavPrevention: true,
postfix: "",
imageUploader:
brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
allowUrls: true
,
onDemand: true,
discardSelector: ".discard-answer"
,immediatelyShowMarkdownHelp:true
);
);
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53296486%2fsingle-seeded-user-on-mongodb-for-logging-into-own-website-to-add-edit-or-dele%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
0
active
oldest
votes
0
active
oldest
votes
active
oldest
votes
active
oldest
votes
Thanks for contributing an answer to Stack Overflow!
- Please be sure to answer the question. Provide details and share your research!
But avoid …
- Asking for help, clarification, or responding to other answers.
- Making statements based on opinion; back them up with references or personal experience.
To learn more, see our tips on writing great answers.
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
StackExchange.ready(
function ()
StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2fstackoverflow.com%2fquestions%2f53296486%2fsingle-seeded-user-on-mongodb-for-logging-into-own-website-to-add-edit-or-dele%23new-answer', 'question_page');
);
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Sign up or log in
StackExchange.ready(function ()
StackExchange.helpers.onClickDraftSave('#login-link');
);
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Sign up using Google
Sign up using Facebook
Sign up using Email and Password
Post as a guest
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
Required, but never shown
