I am using the same connection string on local and production. When the connection string is mongodb://localhost/mydb

What is the username and password? Is it secure to keep it this way?

By default mongodb has no enabled access control, so there is no default user or password.

To enable access control, use either the command line option --auth or security.authorization configuration file setting.

You can use the following procedure or refer to Enabling Auth in the MongoDB docs.

Procedure

1. Start MongoDB without access control.

   mongod --port 27017 --dbpath /data/db1
   

2. Connect to the instance.

   mongo --port 27017
   

3. Create the user administrator.

   use admin
   db.createUser(
     {
       user: "myUserAdmin",
       pwd: "abc123",
       roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
     }
   )
   

4. Re-start the MongoDB instance with access control.

   mongod --auth --port 27017 --dbpath /data/db1
   

5. Authenticate as the user administrator.

   mongo --port 27017 -u "myUserAdmin" -p "abc123" \
     --authenticationDatabase "admin"