Skip to content

Default masterKeyIps does not work on localhost #8316

Closed
#8322
Closed
Default masterKeyIps does not work on localhost#8316
#8322
Labels
block:majorNeeds to be resolved before next major release; remove label afterwardsstate:releasedReleased as stable versionstate:released-alphaReleased as alpha versionstate:released-betaReleased as beta versiontype:bugImpaired feature or lacking behavior that is likely assumed

Description

@dblythy
dblythy
opened on Nov 15, 2022

New Issue Checklist

Issue Description

Introduced in #8281, the new default does not allow local IPs.

This is due to the fact that getClientIp returns an ipv6 IP (::1), whereas the masterKeyIps default is 127.0.0.1

Steps to reproduce

Run a local instance of Parse Server alpha with Dashboard

Actual Outcome

Dashboard should load

Expected Outcome

"MasterKey is required"

Environment

Server

  • Parse Server version: alpha
  • Operating system: macos
  • Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): localhost

Database

  • System (MongoDB or Postgres): mongo
  • Database version: 5.0
  • Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): atlas

Client

  • SDK (iOS, Android, JavaScript, PHP, Unity, etc): js
  • SDK version: 3.4.4

Logs

Activity

  1. parse-github-assistant commented on Nov 15, 2022

    @parse-github-assistant
    parse-github-assistantbot
    on Nov 15, 2022

    Thanks for opening this issue!

    • 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

  2. dblythy commented on Nov 15, 2022

    @dblythy
    dblythy
    on Nov 15, 2022
    MemberAuthor

    Solution is to change the default to ::1, or resolve getClientIp to an ipv4 address

  3. mtrezza commented on Nov 15, 2022

    @mtrezza
    mtrezza
    on Nov 15, 2022
    Member

    Solution is to change the default to ::1

    How would that work on a machine where IPv6 is not enabled? Can't we just add both values as default? ['::1','127.0.0.1']

  4. mtrezza
    added
    type:bugImpaired feature or lacking behavior that is likely assumed
    block:majorNeeds to be resolved before next major release; remove label afterwards
    on Nov 15, 2022

  5. dblythy commented on Nov 15, 2022

    @dblythy
    dblythy
    on Nov 15, 2022
    MemberAuthor

    Yes, that would fix it also. Should masterKeyIps always allow localhost? Otherwise developer will have to configure masterKeyIps: ["::1", "127.0.0.1", "ip", "ip"],

    I'm thinking internally it should be allowedIps = ["::1", "127.0.0.1", ...config.masterKeyIps],, masterKeyIps can default to [] (localhost only)

  6. mtrezza commented on Nov 15, 2022

    @mtrezza
    mtrezza
    on Nov 15, 2022
    Member

    Should masterKeyIps always allow localhost?

    Why?

  7. dblythy commented on Nov 15, 2022

    @dblythy
    dblythy
    on Nov 15, 2022
    MemberAuthor

    I think it would be expected that masterKeyIps is external ips, and that cloud code, code run on the same instance as Parse Server, should always be allowed.

  8. mtrezza commented on Nov 15, 2022

    @mtrezza
    mtrezza
    on Nov 15, 2022
    Member

    How can the use of masterKey be completely disabled?

  9. dblythy commented on Nov 15, 2022

    @dblythy
    dblythy
    on Nov 15, 2022
    MemberAuthor

    Maybe by not setting a masterKey?

  10. mtrezza commented on Nov 15, 2022

    @mtrezza
    mtrezza
    on Nov 15, 2022
    Member

    Does Parse Server start without masterkey?

  11. dblythy commented on Nov 16, 2022

    @dblythy
    dblythy
    on Nov 16, 2022
    MemberAuthor

    Not at the moment

  12. mtrezza commented on Nov 16, 2022

    @mtrezza
    mtrezza
    on Nov 16, 2022
    Member

    Then setting masterKeyIps to an empty array is the only way at the moment. So I'd say we should not set localhost as a non-removable allow-entry.

  13. mtrezza
    closed this as completedin #8322on Nov 25, 2022

  14. parseplatformorg commented on Nov 25, 2022

    @parseplatformorg
    parseplatformorg
    on Nov 25, 2022
    Contributor

    🎉 This change has been released in version 6.0.0-alpha.11

  15. parseplatformorg
    added
    state:released-alphaReleased as alpha version
    on Nov 25, 2022

  16. stewones commented on Nov 27, 2022

    @stewones
    stewones
    on Nov 27, 2022
    Contributor

    Then setting masterKeyIps to an empty array is the only way at the moment. So I'd say we should not set localhost as a non-removable allow-entry.

    it's not working currently @mtrezza

    sent a PR to fix #8339

  17. dblythy commented on Nov 28, 2022

    @dblythy
    dblythy
    on Nov 28, 2022
    MemberAuthor

    So I'd say we should not set localhost as a non-removable allow-entry.

    I think we missed that still though, as the default options are always concatenated to any additional set masterKeyIps

    https://github.com/parse-community/parse-server/blob/alpha/src/ParseServer.js#L471-L473

  18. mtrezza commented on Nov 28, 2022

    @mtrezza
    mtrezza
    on Nov 28, 2022
    Member

    Oh, did #8339 aim to fix that and remove the concatenation? I reopened.

  19. dblythy commented on Nov 28, 2022

    @dblythy
    dblythy
    on Nov 28, 2022
    MemberAuthor

    I don't think so, I think #8339 was designed to make masterKeyIps: [] === access from anywhere, which is incorrect. We can open a new PR fixing the concatenation

  20. stewones commented on Nov 28, 2022

    @stewones
    stewones
    on Nov 28, 2022
    Contributor

    I don't think so, I think #8339 was designed to make masterKeyIps: [] === access from anywhere, which is incorrect. We can open a new PR fixing the concatenation

    sort of, I misunderstood the idea initially but I think it's ok now. please take a 2nd look at the PR

  21. parseplatformorg commented on Jan 31, 2023

    @parseplatformorg
    parseplatformorg
    on Jan 31, 2023
    Contributor

    🎉 This change has been released in version 6.0.0-beta.1

  22. parseplatformorg
    added
    state:released-betaReleased as beta version
    on Jan 31, 2023

  23. parseplatformorg commented on Jan 31, 2023

    @parseplatformorg
    parseplatformorg
    on Jan 31, 2023
    Contributor

    🎉 This change has been released in version 6.0.0

  24. parseplatformorg
    added
    state:releasedReleased as stable version
    on Jan 31, 2023
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    block:majorNeeds to be resolved before next major release; remove label afterwardsstate:releasedReleased as stable versionstate:released-alphaReleased as alpha versionstate:released-betaReleased as beta versiontype:bugImpaired feature or lacking behavior that is likely assumed

    Type

    No type

    Projects

    No projects

      Milestone

      No milestone

      Relationships

      None yet

      Development

      No branches or pull requests

      Issue actions