After I save my user using a third party authentication, some sensitive data keeps saved in the user’s authData field, like the external auth token and id of the user. For security reasons, like to prevent exposing this info in a case where the DB leaks, I wanted to remove the authData value:
Parse.Cloud.afterSave(Parse.User, async request => {
// This prevents an infinite loop from cleaning authdata from the user.
if (!request.object.get("authData")) return;
// Remove session sensitive data from third party auth
request.object.set("authData", null);
request.object.save(null, { useMasterKey: true });
});
Internal (Parse) session info is ok to keep. But external tokens and ids are dangerous.
The field authData does not actually exist in the DB, it is synthesized from the _auth_data_* fields in the DB, so direct manipulation does not work in all cases.
The correct way to delete authData is to either call ParseUser.unlink or via REST call:
body: {
"authData": {
"facebook": null
}
}
Your expectation seems valid and intuitive, so Parse Server should probably interpret a request to set authData to null correctly as removing all authData entries. You could also try to unset the authData field, not sure if that works.
With new handles like validateLogin/validateSignup or even with the validateAuthData
These functions will now be able to return an object that helps the parse-server know what to do with authData.
Ex:
async validateAuthData(authData){
const id = authData.id
// Do your validation stuff
await validateToken(authData.token)
return {
// Only save the id into the DB
save: { id }
// Response object will be available on the login response under `authDataResponse`
// Parse.User.get(‘authDataResponse’).myLoginProvider.message (for example)
// this is optional
response: { message: “Welcome back” }
}
}
Also if you want to prevent authData to be updated on an already existing user
async validateLogin(authData){
const id = authData.id
// Do your validation stuff
await validateToken(authData.token)
return {
// Parse Server will not update authData
// By default Parse always update authData after login/signUp with the new fresh provided authData
// If you implement a custom Auth Provider like an email/password, it could be useful to avoid Parse Server
// to update the hashed password with the clear password provided at login time
doNotSave: true
}
}
