Restful key does not prevent creating new objects

[majd-asab]

Issue
The exact issue is that I dont want restful API to be able to write new objects to classes, so I set up a restful API key which i thought it would prevent any restful calls(a call that doesn't include the restful key) from writing any new objects, however, i am still able to do so(with or without the key).

Steps to reproduce

curl -X POST \

-H "X-Parse-Application-Id: App"
-H "Content-Type: application/json"
-d '{"someKey":"someValue"}'
http://127.0.0.1:1337/somelocation/classes/testClass

Expected Results

Not be able to create new objects to class using restful api

Actual Outcome

able to create new objects

Environment Setup

• Server
  • parse-server version 2.2.12
  • Operating System: ubuntu 14.04
  • Localhost or remote server? local

[steven-supersolid]

Confirmed, e.g. start server with:
npm start -- --appId appId --restAPIKey restAPIKey --masterKey masterKey --databaseURI mongodb://localhost:27017/dev

X-Parse-REST-API-Key can be any value or omitted

A workaround is to start the server with all 4 keys: clientKey, javascriptKey, dotNetKey, restAPIKey
npm start -- --appId appId --restAPIKey restAPIKey --masterKey masterKey --javascriptKey javascriptKey --dotNetKey dotNetKey --clientKey clientKey --databaseURI mongodb://localhost:27017/dev

I think this has been raised before but can't find the issue.

The offending line is here: https://github.com/ParsePlatform/parse-server/blob/master/src/middlewares.js#L136

Not sure why we don't just check if keyMismatch > 0 @flovilmart ?

[flovilmart]

Not sure either but there has to be a reason. There was a lot of back and forth on that piece of code. I'll check the history.

[majd-asab]

Confirmed, initializing with dotNetKey does indeed give the expected out come, thanks for your help.

[steven-supersolid]

Can we keep open? Key checking is not behaving as expected and shouldn't require a workaround. It is a security issue for anyone who doesn't specify all keys.

[flovilmart]

that's effectively a bug... wanna knock it down @steven-supersolid ?

[steven-supersolid]

Sure, I can take a look

[steven-supersolid]

Closing due to merged PR that addresses this issue