You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: README.md
+44-58
Original file line number
Diff line number
Diff line change
@@ -58,6 +58,7 @@ The full documentation for Parse Server is available in the [wiki](https://githu
58
58
-[Basic Options](#basic-options)
59
59
-[Client Key Options](#client-key-options)
60
60
-[Email Verification and Password Reset](#email-verification-and-password-reset)
61
+
-[Password and Account Policy](#password-and-account-policy)
61
62
-[Custom Routes](#custom-routes)
62
63
-[Example](#example)
63
64
-[Reserved Paths](#reserved-paths)
@@ -313,76 +314,32 @@ The client keys used with Parse are no longer necessary with Parse Server. If yo
313
314
314
315
## Email Verification and Password Reset
315
316
316
-
Verifying user email addresses and enabling password reset via email requires an email adapter. As part of the `parse-server` package we provide an adapter for sending email through Mailgun. To use it, sign up for Mailgun, and add this to your initialization code:
317
+
Verifying user email addresses and enabling password reset via email requires an email adapter. There are many email adapters provided and maintained by the community. The following is an example configuration with an example email adapter. See the [Parse Server Options](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) for more details and a full list of available options.
317
318
318
319
```js
319
-
var server =ParseServer({
320
+
constserver=ParseServer({
320
321
...otherOptions,
322
+
321
323
// Enable email verification
322
324
verifyUserEmails:true,
323
325
324
-
// if `verifyUserEmails` is `true` and
325
-
// if `emailVerifyTokenValidityDuration` is `undefined` then
326
-
// email verify token never expires
327
-
// else
328
-
// email verify token expires after `emailVerifyTokenValidityDuration`
329
-
//
330
-
// `emailVerifyTokenValidityDuration` defaults to `undefined`
// account lockout policy setting (OPTIONAL) - defaults to undefined
359
-
// if the account lockout policy is set and there are more than `threshold` number of failed login attempts then the `login` api call returns error code `Parse.Error.OBJECT_NOT_FOUND` with error message `Your account is locked due to multiple failed login attempts. Please try again after <duration> minute(s)`. After `duration` minutes of no login attempts, the application will allow the user to try login again.
360
-
accountLockout: {
361
-
duration:5, // duration policy setting determines the number of minutes that a locked-out account remains locked out before automatically becoming unlocked. Set it to a value greater than 0 and less than 100000.
362
-
threshold:3, // threshold policy setting determines the number of failed sign-in attempts that will cause a user account to be locked. Set it to an integer value greater than 0 and less than 1000.
363
-
unlockOnPasswordReset:true, // Is true if the account lock should be removed after a successful password reset. Default: false.
364
-
}
365
-
},
366
-
// optional settings to enforce password policies
367
-
passwordPolicy: {
368
-
// Two optional settings to enforce strong passwords. Either one or both can be specified.
369
-
// If both are specified, both checks must pass to accept the password
370
-
// 1. a RegExp object or a regex string representing the pattern to enforce
371
-
validatorPattern:/^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.{8,})/, // enforce password with at least 8 char with at least 1 lower case, 1 upper case and 1 digit
372
-
// 2. a callback function to be invoked to validate the password
validationError:'Password must contain at least 1 digit.'// optional error message to be sent instead of the default "Password does not meet the Password Policy requirements." message.
375
-
doNotAllowUsername:true, // optional setting to disallow username in passwords
376
-
maxPasswordAge:90, // optional setting in days for password expiry. Login fails if user does not reset the password within this period after signup/last reset.
377
-
maxPasswordHistory:5, // optional setting to prevent reuse of previous n passwords. Maximum value that can be specified is 20. Not specifying it or specifying 0 will not enforce history.
378
-
//optional setting to set a validity duration for password reset links (in seconds)
379
-
resetTokenValidityDuration:24*60*60, // expire after 24 hours
380
-
}
381
337
});
382
338
```
383
339
384
-
You can also use other email adapters contributed by the community such as:
385
-
-[parse-smtp-template (Multi Language and Multi Template)](https://www.npmjs.com/package/parse-smtp-template)
340
+
Email adapters contributed by the community:
341
+
-[parse-server-api-mail-adapter](https://www.npmjs.com/package/parse-server-api-mail-adapter) (localization, templates, universally supports any email provider)
Set a password and account policy that meets your security requirements. The following is an example configuration. See the [Parse Server Options](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) for more details and a full list of available options.
356
+
357
+
```js
358
+
constserver=ParseServer({
359
+
...otherOptions,
360
+
361
+
// The account lock policy
362
+
accountLockout: {
363
+
// Lock the account for 5 minutes.
364
+
duration:5,
365
+
// Lock an account after 3 failed log-in attempts
366
+
threshold:3,
367
+
// Unlock the account after a successful password reset
368
+
unlockOnPasswordReset:true,
369
+
},
370
+
371
+
// The password policy
372
+
passwordPolicy: {
373
+
// Enforce a password of at least 8 characters which contain at least 1 lower case, 1 upper case and 1 digit
'an existing email verify token should be reused when resend verification email is requested',
131
+
'Set to `true` if a email verification token should be reused in case another token is requested but there is a token that is still valid, i.e. has not expired. This avoids the often observed issue that a user requests multiple emails and does not know which link contains a valid token because each newly generated token would invalidate the previous token.<br><br>Default is `false`.<br>Requires option `verifyUserEmails: true`.',
help: 'Email verification token validity duration, in seconds',
137
+
help:
138
+
'Set the validity duration of the email verification token in seconds after which the token expires. The token is used in the link that is set in the email. After the token expires, the link becomes invalid and a new link has to be sent. If the option is not set or set to `undefined`, then the token never expires.<br><br>For example, to expire the token after 2 hours, set a value of 7200 seconds (= 60 seconds * 60 minutes * 2 hours).<br><br>Default is `undefined`.<br>Requires option `verifyUserEmails: true`.',
'Prevent user from login if email is not verified and PARSE_SERVER_VERIFY_USER_EMAILS is true, defaults to false',
318
+
'Set to `true` to prevent a user from logging in if the email has not yet been verified and email verification is required.<br><br>Default is `false`.<br>Requires option `verifyUserEmails: true`.',
'number of minutes that a locked-out account remains locked out before automatically becoming unlocked.',
709
+
'Set the duration in minutes that a locked-out account remains locked out before automatically becoming unlocked.<br><br>Valid values are greater than `0` and less than `100000`.',
708
710
action: parsers.numberParser('duration'),
709
711
},
710
712
threshold: {
711
713
env: 'PARSE_SERVER_ACCOUNT_LOCKOUT_THRESHOLD',
712
-
help: 'number of failed sign-in attempts that will cause a user account to be locked',
714
+
help:
715
+
'Set the number of failed sign-in attempts that will cause a user account to be locked. If the account is locked. The account will unlock after the duration set in the `duration` option has passed and no further login attempts have been made.<br><br>Valid values are greater than `0` and less than `1000`.',
help: 'Is true if the account lock should be removed after a successful password reset.',
720
+
help:
721
+
'Set to `true` if the account should be unlocked after a successful password reset.<br><br>Default is `false`.<br>Requires options `duration` and `threshold` to be set.',
help: 'setting to prevent reuse of previous n passwords',
742
+
help:
743
+
'Set the number of previous password that will not be allowed to be set as new password. If the option is not set or set to `0`, no previous passwords will be considered.<br><br>Valid values are >= `0` and <= `20`.<br>Default is `0`.',
'Set to `true` if a password reset token should be reused in case another token is requested but there is a token that is still valid, i.e. has not expired. This avoids the often observed issue that a user requests multiple emails and does not know which link contains a valid token because each newly generated token would invalidate the previous token.<br><br>Default is `false`.',
'Set the validity duration of the password reset token in seconds after which the token expires. The token is used in the link that is set in the email. After the token expires, the link becomes invalid and a new link has to be sent. If the option is not set or set to `undefined`, then the token never expires.<br><br>For example, to expire the token after 2 hours, set a value of 7200 seconds (= 60 seconds * 60 minutes * 2 hours).<br><br>Default is `undefined`.',
help: 'a callback function to be invoked to validate the password',
766
+
help:
767
+
'Set a callback function to validate a password to be accepted.<br><br>If used in combination with `validatorPattern`, the password must pass both to be accepted.',
help: 'a RegExp object or a regex string representing the pattern to enforce',
771
+
help:
772
+
'Set the regular expression validation pattern a password must match to be accepted.<br><br>If used in combination with `validatorCallback`, the password must pass both to be accepted.',
0 commit comments