How secure is Cloud Code?

cbaker6 · April 21, 2022, 11:03am

You can query the session token and check that expiresAt is still valid. Here’s the starter, and you can figure out how to compare expiresAt to the current date:

github.com

netreconlab/parse-hipaa/blob/5cada4f69c5d58f5be7c834a3188d2810b6e7ad1/parse/cloud/files.js#L4-L21

    
      
          const { file, user } = request;
          const token = { sessionToken: user.getSessionToken() };
          
          
const sessionQuery = new Parse.Query(Parse.Session);
          sessionQuery.equalTo('sessionToken', sessionToken);
          sessionQuery.include('user');
          
          
const foundSession = await sessionQuery.first({
              sessionToken
          });
          
          
if (!foundSession) {
            throw new Error('Invalid session token.');
          }
          
          
if (user != foundSession.get('user')){
            throw new Error('This session does not belong to this user');
          }