# How secure is Cloud Code?

**URL:** <https://community.parseplatform.org/t/how-secure-is-cloud-code/2594>\
**Category:** Cloud Code\
**Created:** [April 15, 2022, 6:42pm UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594 "2022-04-15T18:42:50Z")\
**Posts on this page:** 10\
**Page:** 1

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 15, 2022, 6:42pm UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/1 "2022-04-15T18:42:50Z")

</div>

Can someone help me understand how secure CloudCode is? Like who can access it? Is it publicly available / open like an API?

And if someone somehow knows the cloudcode functions, can they just start calling it and wreck havok if they have like the clientkey and applicationId?

Basically I’m trying to figure out what functions I can move to CloudCode and what should be kept off. Like I’m assuming deleteUser(with: userId) with a masterkey should be kept off CloudCode as someone can easily just send a call to that cloudcode function and delete a user but deleteUser with the proper ACL / CLP might be doable ?

What kind of security issues should I watch out for when creating / running cloudcode functions?

thanks in advance.

---

<div class="post-metadata">

**Author:** ![davimacedo](https://community.parseplatform.org/user_avatar/community.parseplatform.org/davimacedo/32/316_2.png) [@davimacedo](https://community.parseplatform.org/u/davimacedo)\
**Post date:** [April 18, 2022, 4:41am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/2 "2022-04-18T04:41:25Z")

</div>

Cloud code is public available for anyone who knows that it exists and has the keys. In order to turn it secure, you have to implement your own logic on cloud code to check if the user calling it has access to perform the operation.

---

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 21, 2022, 3:51am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/3 "2022-04-21T03:51:48Z")

</div>

thanks @davimacedo !

something like this with a check if a user is logged in best way to do it you think?

> <https://stackoverflow.com/questions/55950549/is-it-possible-to-check-is-parse-user-is-logged-in-from-the-server-side/56124709#56124709>

or does anyone know of the proper way to check if a user requesting is logged in properly?

thanks in advance.

---

<div class="post-metadata">

**Author:** ![uzaysan](https://community.parseplatform.org/user_avatar/community.parseplatform.org/uzaysan/32/59_2.png) [@uzaysan](https://community.parseplatform.org/u/uzaysan)\
**Post date:** [April 21, 2022, 6:31am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/4 "2022-04-21T06:31:58Z")

</div>

On cloud code if user is logged in request.user will be the user thats logged in in the client app. İf the not logged in, request.user will be undefined.

```auto
Parse.Cloud.define("someCloudCode", async (request) => {
  if (request.user) {
    // request.user is defined. User is logged in.
  }
  else {
    // request.user is undefined or null. Not logged in.
  }
});

```

---

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 21, 2022, 7:07am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/5 "2022-04-21T07:07:42Z")

</div>

Got it. thanks @uzaysan

Follow up question, wouldn’t the user object be easily spoofed by a skilled hacker?

With that in mind, I’ve been trying to see if it’s possible to check if the token I get back from

`user.getSessionToken()`

is a valid one just for that extra security but I can’t seem to find a way to check if the sessiontoken attached to the user object is valid.

Any ideas / leads?

thanks a bunch

---

<div class="post-metadata">

**Author:** ![cbaker6](https://community.parseplatform.org/user_avatar/community.parseplatform.org/cbaker6/32/114_2.png) [@cbaker6](https://community.parseplatform.org/u/cbaker6)\
**Post date:** [April 21, 2022, 11:03am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/6 "2022-04-21T11:03:34Z")

</div>

You can query the session token and check that `expiresAt` is still valid. Here’s the starter, and you can figure out how to compare `expiresAt` to the current date:

> <https://github.com/netreconlab/parse-hipaa/blob/5cada4f69c5d58f5be7c834a3188d2810b6e7ad1/parse/cloud/files.js#L4-L21>

---

<div class="post-metadata">

**Author:** ![dblythy](https://community.parseplatform.org/user_avatar/community.parseplatform.org/dblythy/32/231_2.png) [@dblythy](https://community.parseplatform.org/u/dblythy)\
**Post date:** [April 21, 2022, 12:14pm UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/7 "2022-04-21T12:14:36Z")

</div>

I might be corrected, but isn’t `request.user` inferred internally from the request’s session token? It’s not possible for a hacker to set the requests’ user, they can only set the session token. Middleware auth then looks up this session token and then sets `req.user`, if the token is valid and not expired. Otherwise, req.user will be empty.

---

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 25, 2022, 6:28am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/9 "2022-04-25T06:28:29Z")

</div>

Looking into this now. I appreciate it a lot sir!

---

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 25, 2022, 6:59am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/10 "2022-04-25T06:59:50Z")

</div>

thank you. that makes sense. 🙂

---

<div class="post-metadata">

**Author:** ![jayson](https://community.parseplatform.org/user_avatar/community.parseplatform.org/jayson/32/679_2.png) [@jayson](https://community.parseplatform.org/u/jayson)\
**Post date:** [April 25, 2022, 8:32am UTC](https://community.parseplatform.org/t/how-secure-is-cloud-code/2594/11 "2022-04-25T08:32:47Z")

</div>

I just found out that the starting Parse Server Cloud Code 4.4, there’s a new Cloud Code Validation feature that could work as well.

[Link to Cloud Code Docs](https://docs.parseplatform.org/cloudcode/guide/#implementing-cloud-function-validation)

Which basically allows checking of a variable and if a user is defined. There are also more advanced options mentioned in the document.

Here is the example from the link Cloud Code Documentation:

```auto
Parse.Cloud.define("averageStars", async (request) => {
  const query = new Parse.Query("Review");
  query.equalTo("movie", request.params.movie);
  const results = await query.find();
  let sum = 0;
  for (let i = 0; i < results.length; ++i) {
    sum += results[i].get("stars");
  }
  return sum / results.length;
},{
  fields : ['movie'],
  requireUser: true
});

```