Skip to content

Client Keys aren't enforced even when defined #1733

Closed

Description

@natanrolnik

Environment Setup

  • Server: 2.2.7 on Heroku

Steps to reproduce

  • Setup a Parse Server with applicationId, masterKey, and at least one of the client keys (rest api, dot net, or client key). In this case, set the restAPIKey.
  • Issue a request with the headers X-Parse-Application-Id and X-Parse-Rest-API-Key.
  • See that the request succeeded
  • Now, replace the original value used on X-Parse-Rest-API-Key with Bananas

The ReadMe states that:

Setting any of these keys will require all requests to provide one of the configured keys.

However, if you try to reproduce it with the steps above, you will see that the keys aren't really enforced, even when a few of them are being defined when Parse Server is initialized. When running the same request with the same headers, but pointing to api.parse.com/1, the result is {"error": "unauthorized"}.

Activity

  1. drew-gross commented on May 17, 2016

    @drew-gross
    Contributor

    Closing to avoid duplicating discussion as we are discussing stuff in #1789.

    If you have a good use case for client keys and think we should keep them, please post it there.

  2. natanrolnik commented on May 18, 2016

    @natanrolnik
    ContributorAuthor

    I initially posted here, but then I realized I should post on #1789 😁

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions