Role on mongodb - can insert even the user is not authorized - mongodb

Question

I create 2 db, and one user per db, but user 2 can insert in db1?
use shop
db.createUser({user: "appdev",pwd:"appdev", roles:["readWrite"]})
db.auth("appdev","appdev")
show collections
db.products.insertOne({name: "A book for appdev"})
db.logout()
use shop2
db.createUser({user: "appdev2",pwd:"appdev2", roles:["readWrite"]})
db.auth("appdev2","appdev2")
show collections
db.products.insertOne({name: "A book for appdev2"})
Here, I still logged as appdev2 and can insert on db shop.
use shop
db.products.insertOne({name:"i-am-appdev2"})
{
"acknowledged" : true,
"insertedId" : ObjectId("5d8fdba878f7555a2060f1ec")
}

Answer 1

If your transcript is accurate, it looks like like either:
You haven't enabled access control by setting security.authorization to true in your mongod config or starting mongod with --auth.
You are logged in as a more privileged user (since you are able to run db.createUser() in the same session).
To investigate these possibilities in the mongo shell:
Make sure authorization is enabled via the output of db.serverCmdLineOpts(). If access control is enabled, the output of the parsed server configuration options should include a section like:
"security" : {
"authorization" : "enabled"
},
Check users & roles for the current session via db.runCommand({connectionStatus:1}). As noted in Authenticate a User:
Authenticating multiple times as different users does not drop the credentials of previously-authenticated users. This may lead to a connection having more permissions than intended by the user, and causes operations within a logical session to raise an error.
Access control is a separate option from configuring Role-Based Access Control (RBAC) to allow for scenarios like resetting admin access. Multiple concurrent logins provide additive permissions, but are mostly a legacy carryover from more simplistic versions of access control in earlier versions of MongoDB.
For more information on available security measures, see the Security Checklist in the MongoDB manual.