Question

Let’s say I have a collection of documents such as:

{ "_id" : 0 , "owner":0 "name":"Doc1"},{ "_id" : 1 , "owner":1, "name":"Doc1"}, etc

And, on the other hand the owners are represented as a separate collection:

{ "_id" : 0 , "username":"John"}, { "_id" : 1 , "username":"Sam"}

How can I make sure that, when I insert a document it references the user in a correct way. In old-school RDBMS this could easily be done using a Foreign Key.

I know that I can check the correctness of insertion from my business code, BUT what if an attacker tampers with my request to the server and puts “owner” : 100, and Mongo doesn’t throw any exception back.

I would like to know how this situation should be handled in a real-word application.

Thank you in advance!

Answer 1

MongoDB doesn’t have foreign keys (as you have presumably noticed). Fundamentally the answer is therefore, “Don’t let users tamper with the requests. Only let the application insert data that follows your referential integrity rules.”

MongoDB is great in lots of ways… but if you find that you need foreign keys, then it’s probably not the correct solution to your problem.