Skip to content

Disable anonymous API requests #327

Closed

Description

@nitrag

The Dashboard has a setting:
"Allow anonymous users".

How do we set this to false? I want to require that all API requests are from a logged in user (unless they are signing up or logging in).

Activity

  1. drew-gross commented on Feb 10, 2016

    @drew-gross
    Contributor

    Currently that is not available in parse-server. Want to submit a PR?

  2. nitrag commented on Feb 10, 2016

    @nitrag
    Author

    I would be happy to take a stab at it. Someone needs to point me in the right direction though...haven't worked on a Node app before.

  3. drew-gross commented on Feb 10, 2016

    @drew-gross
    Contributor

    Sure. You can take a look at src/index.js to see how config parameters (args) are handled by parse-server. You will want to add an additional parameter for anonymous users. Then, in src/RestWrite.js you will have to check the status of that config parameter whenever creating an anonymous user. You can check the parameter in this.config. You will also need to add some tests in spec/ParseUser.spec.js which might be trickier. I can help you with that when you get there.

  4. nitrag commented on Feb 10, 2016

    @nitrag
    Author

    I'm not understanding what you mean by "creating an anonymous user". So when a API request comes in, if there is no authentication info it tries to create an anonymous user? Where is that line of code?

    I really don't understand the handleAnonymousAuthData of RestWrite. Where does "this.data.authData.anonymous" come from? What is an anonymous provider?

    I'm also inferring based on your description that every API request requires a user object before API requests can be made and RestWrite occurs before RestQuery?

  5. drew-gross commented on Feb 10, 2016

    @drew-gross
    Contributor

    Looks like there is some additional discussion and work getting started in #218 and #341. Take at look at the PR to see how those are done (bugfixes for anonymous users), hopefully that can help you get started.

  6. nitrag commented on Feb 12, 2016

    @nitrag
    Author

    @steven-supersolid since you just were messing around with PR #341 and anonymous users, maybe you can help me determine where to throw an error for this. I'm not sure at exactly which point in RestWrite the user is determined to be anonymous.

  7. flovilmart commented on Feb 16, 2016

    @flovilmart
    Contributor

    @drew-gross @nitrag I'll get a shot a this, adding enableAnonymousUser: false to the configuration.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions