Repository navigation
Why parse.com return sessionToken with MasterKey #1617
Description
sessionToken is removed when query in Cloud code with Master Key. due to changes of #1498.
I do some experiment on parse.com
==> when /1/login with username and password, it returns
{
"sessionToken": "r:NmElS2PLfszu5fPnwtGbaa4L9",
"authData": {...}
}
==> when /1/users/my_objectId with MasterKey, it returns
{
"sessionToken": "u5fPnwtGNmElS2PLfszbaa4L9",
"authData":{...}
}
This shows that parse.com will return sessionToken (the legancy session token, not revocable token). But after #1498, this feature is not the same with official parse.com .
I'm getting confused. Should i change my cloud code to fit changes of #1498 or #1498 should be rollback.
Activity
steven-supersolid commentedon Apr 25, 2016
#1498 removed the authData and sessionToken with master key or authorised user.
#1574 adds the authData back in as the removal was a bug.
I would change your cloud code if it requires sessionToken, but not if it requires authData as that will be coming back.
cyu commentedon Apr 26, 2016
It is documented in the parse reference that a session token would be returned if a master key is provided: https://parse.com/docs/js/api/classes/Parse.User.html#methods_getSessionToken
I'm looking to get a session token so I can create custom login. If I can't get it this way, what is the preferred way to get a session token for a user?
lenew commentedon Apr 26, 2016
I don't think it is a good idea to have different behavior with this. Especially during this migration moment.
lenew commentedon Apr 26, 2016
Another problem.
In Routers/ClassRouter.js, handleGet also delete sessionToken.
This is also different whith the behavior documented in https://parse.com/docs/js/api/classes/Parse.User.html#methods_getSessionToken
when query with Master Key.
drew-gross commentedon Apr 26, 2016
You are linking to the JS SDK docs, not the REST API. Parse Server doesn't support non-revocable sessions, so that could be the cause of the difference you are seeing.
cyu commentedon Apr 27, 2016
@drew-gross So sessionTokens are artifacts of non-revocable tokens? If so, can you point me to how I would go about implementing a custom login implementation?
drew-gross commentedon Apr 28, 2016
Here is how you use revocable sessions: http://blog.parse.com/announcements/announcing-new-enhanced-sessions/