Document security considerations #856
chimaerase
started this conversation in
Feature Request
Replies: 0 comments
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
-
Looking over Beanie's (great!) documentation, I don't see any mention yet of security. Coming from the Django ORM, I generally expect ORM's / ODM's to do things like:
E.g. to avoid injection attacks (which still apply to NoSQL).
I understand that making Beanie documents Pydantic models will cover many input validation cases, but perhaps not all. For example, if I do something like
MyDocument.get(user_provided_string)
, is that a potential attack vector? As someone relatively new to MongoDB and to Beanie (coming from Postgres & Django ORM), I wasn't able to easily get a sense of whether these things are considered in Beanie. If they are, suggest specifically calling them out in the docs. If not, I'd suggest to consider documenting that too, especially what clients' responsibilities are for security concerns not handled in Beanie.Beta Was this translation helpful? Give feedback.
All reactions