Do you need ssl for communication between mongolab and heroku?

Question

Is it safe to send data to the free mongolab database from heroku app.

The data may be similar to emails and preferences.

Or do you need ssl, I read about mongodb ssl.

I asked, but could not find anything special for the Mongolab.

Answer 1

I did the same as you and sent an email to ask mongolab in detail. I got an answer, shared it with you and hope that it can help you. Below is the answer.

As long as your Heroku application and the MongoLab database are in the same cloud region, we consider it safe to communicate between Heroku and MongoLab, since the AWS infrastructure prevents sniffing packages within regions. If you use the MongoLab addon on Heroku, it is automatic, but if you use the deployment provided directly on mongolab.com you need to manually select the appropriate area.

It seems that the connection between the Heroku and the Mongolab is in the same region. Both are AWS protected, so I assume you don't need SSL. If you want this to be very secure, you still need SSL for added security.

Hope this helps

Answer 2

From the MongoLab documentation:

Connecting to your database

You should always try to host your application infrastructure and your database on the same local network (i.e. datacenter / cloud region), as this will be the safest way to deploy and will minimize the delay between your application and the database.

When you connect to the MongoLab database from the same data center / region, you exchange your cloud hosting providers on the internal network. All of our cloud service providers provide a good deal with network security infrastructure to isolate tenants. hypervisors do not allow virtual machines to read network traffic addressed to other virtual machines, and therefore no other tenant can sniff your traffic.

However, when you connect to the MongoLab database from another data center / region, your messages are less secure. As long as the database requires authentication of the username and password (with credentials that are always encrypted on the network), the rest of your data is transmitted unencrypted over the open Internet. As such, you are potentially vulnerable to others sniffing your traffic.

Using MongoDB with SSL Connections

Available for dedicated plans that use only MongoDB version 2.6+

To ensure the security of communication with your database, MongoLab offers MongoDB encrypted SSL connections in dedicated plans using MongoDB 2.6 or later. Even with SSL, we still recommend that you host the application infrastructure and your database in the same data center / region to minimize latency and add another layer of security.