Only allow basic auth credentials with a known appId #2574
Conversation
ghost
added
the
Current coverage is 92.15% (diff: 100%)@@ master #2574 diff @@
==========================================
Files 97 97
Lines 11927 11930 +3
Methods 1454 1454
Messages 0 0
Branches 1929 1930 +1
==========================================
+ Hits 10986 10994 +8
+ Misses 941 936 -5
Partials 0 0
|
|
@gyratorycircus updated the pull request - view changes |
|
@gyratorycircus updated the pull request - view changes |
|
LGTM! |
* ParsePlatform/master: (100 commits) Only allow basic auth credentials with a known appId (parse-community#2574) vk.com provider registered (parse-community#2579) chore(package): update parse-server-push-adapter to version 1.1.0 (parse-community#2588) vk.com auth data manager implemented (parse-community#2578) Fix a typo (parse-community#2563) Makes sure routes don't overlap and yield a header set error (parse-community#2559) Postgres: $all, $and CLP and more (parse-community#2551) Changelog 2.2.18 (parse-community#2558) chore(package): update winston-daily-rotate-file to version 1.3.0 (parse-community#2547) chore(package): update parse-server-s3-adapter to version 1.0.5 (parse-community#2536) Adds bcrypt native binding for better login performance (parse-community#2549) chore(package): update mongodb to version 2.2.7 (parse-community#2554) Make parse-server cloud code logging closer parse.com legacy (parse-community#2550) chore(package): update pg-promise to version 5.3.1 (parse-community#2519) Postgres: Operations, Hooks, OAuth login, Files support (parse-community#2528) Syncing afterSave/afterDelete trigger calls (Issue parse-community#2489) (parse-community#2499) Updated README.md (parse-community#2538) Fix capitalization, typo, and grammar mistake (parse-community#2533) Update ISSUE_TEMPLATE.md fix typo (parse-community#2525) ...
|
Can someone help me with basic auth on Parse Server? Basically, I think I need the syntax for adding the masterKey... I have a Parse Server installed on Heroku with Parse Cloud code that I can verify is handling POSTs via "curl" commands, but am getting authorization errors via "basic HTTP authentication". This works (I have taken out the -d data clause for clarity): curl -X POST -H "X-Parse-Application-Id: " -H "X-Parse-Master-Key: KEY" -H "X-Parse-REST-API-Key: KEY" -H "Content-Type: application/json" https://SERVER.herokuapp.com/parse/functions/bloodPressureMonitorData this URL w/basic authentication does not: https://KEY:javascript-key:[email protected]/parse/functions/bloodPressureMonitorData Maybe I need the "master key" too? But I don't know the syntax for that... |
This allows basic auth credentials to be used for the appId, masterKey, and javascriptKey only when the basic auth username is a known appId, otherwise the header or body params will be used for credentials as usual. Addresses issue #2573.