Parse Security - How to improve default security?

Parse Server šŸ“”
#21

Iā€™d go with an option to disable the security checks.

#22

Thanks to @dblythyā€™s PR this topic is picking up speed.

I think once the PR is merged, it would be good if someone from the core team would reach out to the video author and thank them for the critical security analysis and the subsequent discussion it triggered in our community. Once we have a nice dashboard view for the security checks, maybe we can motivate the video author to update their video or release another one. I assume improving security is - and should be - the single underlying motivation of analysis like these, so I would expect that both the author and our community can claim a win in demonstrating that this process works.

2 Likes
#23

Hereā€™s a blog @dplewis shared with me. Itā€™s from the same author of the video. Some of the information is the same, but goes into some more details. It will be good to address as much as possible: https://healdb.tech/blog/parse.html

1 Like
#24

@RodrigoSMarques thank you for this post, this has lead to some great improvements to Parse Server, such as:

  • Parse Server restricts fileUpload to logged in users only
  • Parse Dashboard can be used with 2FA
  • Parse Server has the SecurityChecks feature which checks for common misconfigurations

Note that enabling these features does not guarantee security of data. With Parseā€™s flexibility, itā€™s up to you to make sure that data is restricted, and that weak points in your server stack are protected.

An example of a common vulnerability is returning a full Parse.Object that has been fetched with a masterKey from a Cloud Function.

Parse.Cloud.define('getObject', () => {
  return new Parse.Query('Objects').find({useMasterKey: true});
});

This cloud function will return all objects to the user, regardless of ACL. This is just an example of how data security is in the hands of the developer.

Generally, I write my Unit Tests at the start of a project to cover common security protocols that I want the application to follow, such as:

  • Ensuring users canā€™t query other users
  • Ensuring users canā€™t edit other users
  • Ensuring certain data isnā€™t returned from cloud functions / queries (making sure sensitive data is stripped out if required)
  • Ensuring cloud functions only return the data that is necessary

We are continuing to work on Parse Server security and welcome any suggestions or ideas :blush:

3 Likes
#25

My english is not perfect but I would understand this the other way. Did you mean ā€œallowsā€ instead of ā€œpreventsā€?

I have not found any flag in server options in the documentation. It the public upload blocked by default or is there undocumented option to setup? I would like to check that for properly setting it on Back4App service.

Thank you!

#26

Youā€™re correct, itā€™s a double negative. Iā€™ve edited my comment.

These changes are on the master branch only, soon to be released on V5!

#27

Perhaps to confirm my understanding, these will be activated by default and no entry in the config is necessary, correct?

Thank you!

#28

Although we are hoping to continue to evolve Parse Server, we donā€™t want to force developers into time consuming changes. Breaking changes are a source of frustration for our community.

Public fileUpload is the only breaking change. SecurityChecks and MFA for dashboard will need to be activated manually. Although if youā€™re using B4A, you should already be able to use MFA on their dashboard, and your masterKey / databaseURL is probably already secure (as they are autogenerated).

#29

I canā€™t find any docs on enableAnonymousUsers with the exception of the Parse Server API doc that only mentions that it exists.

I looked in the following locations for further explanation.

So when you mention lazy developers you must be referring to the ones maintaining the docs?

This is my first time using Parse so I like to read through the docs so that I understand how to use the tech and make sure I am not getting myself into trouble. Iā€™m not going to read source code just to figure out how a certain config option works. Bullet point #1 in your post is the most information about enableAnonymousUsers that I have been able to find so far.

#30

Hi @jbeckton! Our project and docs are community maintained, meaning that we all volunteer our time to improve docs and source code. I have opened an issues in the docs repo and Parse Server repo to change the default value for enableAnonymousUsers :blush: