In my case the database already had some users configured. But because I did't start the server with --auth option, MongoDB ignored all users and allowed everyone to connect.
- Why should it be disabled by default?
I don't agree it should, but understand why it is disabled by default: for easy and quick start of development on the local machine.
I also have been affected by the same "hack".
Turns out I have simply forgot to start mongod with --auth option, even through the I had created users for different databases, including the admin!
Looks like in "non secure mode" it allows logins with existing users as well as non-authorized.
I understand why the authentication is disabled by default, but it should fail to start with a DB that has users with roles and stuff.
In my case the database already had some users configured. But because I did't start the server with --auth option, MongoDB ignored all users and allowed everyone to connect.