Security
Credentials and Network Access
Environment variables, secret managers, IP allowlists — not connection strings in git.
The URI is a secret. It does not belong in git, in a screenshot, or in NEXT_PUBLIC_*. Network policy is the other half: Atlas should not be 0.0.0.0/0 'so the demo works' on a cluster that holds orders.
- Storage.
process.env.MONGO_URIlocally. Secret manager (or platform env) in production. Rotate when someone leaves or a laptop is lost. - TLS.
mongodb+srvis TLS. Do not disable certificate validation to 'fix' a laptop trust store. - IP access list. App egress IPs (or Atlas PrivateLink / VPC peering) — not the whole internet.
- No browser. The driver stays on the server (Node.js module). A connection string in client-side JS is a public cluster.
MONGO_URI=mongodb+srv://orders-api:REDACTED@cluster.mongodb.net/app?retryWrites=true&w=majorityConnection pooling does not replace this: one client still uses one user. If that user is over-privileged, every handler is. Firewall + least privilege + secrets is the three-layer answer; any one missing is how a leaked .env from a frontend build becomes a dropped collection.
Interview question
How do you protect a MongoDB connection string in a web app?
Keep it on the server in environment variables or a secret manager, never in git or NEXT_PUBLIC. Atlas IP allowlist or private networking, not 0.0.0.0/0. mongodb+srv uses TLS; I do not turn verification off. The browser never sees the URI.