Skip to main content
interlace
Plugin: mongodb-securityRules

require-auth-mechanism

Requires explicit authentication mechanism specification for MongoDB connections.

⚠️ This rule warns by default in the recommended config.

Quick Summary

AspectDetails
CWE ReferenceCWE-287 (Improper Authentication)
OWASPA07:2021 - Identification/Auth Failures
SeverityMedium (CVSS: 6.5)
CategorySecurity

Error Message Format

The rule provides LLM-optimized error messages (Compact 2-line format) with actionable security guidance:

🔒 CWE-287 OWASP:A07 CVSS:9.8 | Improper Authentication detected | CRITICAL
   Fix: Review and apply the recommended fix | https://owasp.org/Top10/A07_2021/

Message Components

ComponentPurposeExample
Risk StandardsSecurity benchmarksCWE-287 OWASP:A07 CVSS:9.8
Issue DescriptionSpecific vulnerabilityImproper Authentication detected
Severity & ComplianceImpact assessmentCRITICAL
Fix InstructionActionable remediationFollow the remediation steps below
Technical TruthOfficial referenceOWASP Top 10

Rule Details

Explicit authentication mechanism ensures:

  • No fallback to weaker mechanisms
  • Clear security configuration
  • Defense against downgrade attacks

❌ Incorrect

// No explicit auth mechanism - may default to legacy SCRAM-SHA-1
mongoose.connect('mongodb://user:pass@host/db');

// Only credentials, no mechanism specified
mongoose.connect(uri, {
  user: 'admin',
  pass: 'secret',
});

✅ Correct

// Explicit SCRAM-SHA-256 (recommended)
mongoose.connect(uri, {
  authMechanism: 'SCRAM-SHA-256',
});

// MongoDB Atlas X.509
mongoose.connect(uri, {
  authMechanism: 'MONGODB-X509',
  tlsCertificateKeyFile: '/path/to/client.pem',
});

// AWS IAM authentication
mongoose.connect(uri, {
  authMechanism: 'MONGODB-AWS',
});

Receiver Requirement

A .connect() is not evidence of MongoDB. Redis clients, TypeORM query runners and pino transports all have one, and naming another database's connection "MongoDB" is worse than staying silent. This rule only fires when the receiver is bound to a mongodb/mongoose import, is a new MongoClient(...), or is named mongo*.

// ✅ Not reported — Redis
const client = createClient({ url: REDIS_URL });
await client.connect();

// ✅ Not reported — TypeORM
const queryRunner = this.repository.manager.connection.createQueryRunner();
await queryRunner.connect();

allowInTests (on by default) also covers files under test/, tests/, __tests__/, __mocks__/, e2e/ and fixtures/ directories, not just *.test.ts / *.spec.ts — testcontainers helpers are not production connections.

When Not To Use It

  • Development environments with passwordless local MongoDB
  • When using MongoDB Atlas with default secure configuration

Known False Negatives

The following patterns are not detected due to static analysis limitations:

Connection String with Auth

Why: URI parsing is not performed; only options object is checked.

// ❌ NOT DETECTED - Auth mechanism in URI
mongoose.connect('mongodb://host/db?authMechanism=SCRAM-SHA-1'); // Weak mechanism in URI

Mitigation: Use options object for auth mechanism. Validate URIs at startup.

Options from Variable

OptionTypeDefaultDescription
allowInTestsbooleantrueSkip this rule in *.test.* / *.spec.* files

Why: Variable contents are not analyzed.

// ❌ NOT DETECTED - Options from variable
const opts = { user: 'admin', pass: 'secret' }; // Missing authMechanism
mongoose.connect(uri, opts);

Mitigation: Use inline options. Define typed connection config.

Environment-Based Options

Why: Environment values are not known at lint time.

// ❌ NOT DETECTED - Options depend on environment
const opts = process.env.USE_X509
  ? { authMechanism: 'MONGODB-X509' }
  : { user: 'admin', pass: 'secret' }; // Fallback has no mechanism!
mongoose.connect(uri, opts);

Mitigation: Always include authMechanism in all branches.

Native Driver Direct Use

Why: Only Mongoose patterns are recognized by default.

// ❌ NOT DETECTED - Native driver
import { MongoClient } from 'mongodb';
const client = new MongoClient(uri, {
  auth: { username: 'admin', password: 'secret' },
});
// Missing authMechanism on native driver

Mitigation: Configure rule to recognize MongoClient patterns.

References

Did this rule catch something? Star the repo to get new CWE coverage as we ship it — or follow the AI-code-security benchmarks behind these rules.