Security hardening Steps for NodeJs + Mongoose
1. Use env variables instead of hardcoded apis/resources.
2. enable strict query mode
mongoose.set('strictQuery', true);
3. Sanitize input and validate objects.
const isValidId = mongoose.Types.ObjectId.isValid(id);
if (!isValidId) throw new Error('Invalid ID');
4. Use Mongoose schema validation.
5. Avoid wildcard/generic queries which can pass unsanitized objects.
6. Enforce DB authentication by using specific user roles, disabling remote access, enable TLS.
7. Add API security if using expressJS.