# Remove sensitive data from authData

**URL:** <https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377>\
**Category:** Cloud Code\
**Created:** [January 22, 2022, 7:00pm UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377 "2022-01-22T19:00:18Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![rhuanbarreto](https://community.parseplatform.org/user_avatar/community.parseplatform.org/rhuanbarreto/32/151_2.png) [@rhuanbarreto](https://community.parseplatform.org/u/rhuanbarreto)\
**Post date:** [January 22, 2022, 7:00pm UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/1 "2022-01-22T19:00:18Z")

</div>

After I save my user using a third party authentication, some sensitive data keeps saved in the user’s `authData` field, like the external auth token and id of the user. For security reasons, like to prevent exposing this info in a case where the DB leaks, I wanted to remove the `authData` value:

```auto
Parse.Cloud.afterSave(Parse.User, async request => {
  // This prevents an infinite loop from cleaning authdata from the user.
  if (!request.object.get("authData")) return;

  // Remove session sensitive data from third party auth
  request.object.set("authData", null);
  request.object.save(null, { useMasterKey: true });
});

```

Internal (Parse) session info is ok to keep. But external tokens and ids are dangerous.

In this code, I get the error:

`Error: This authentication method is unsupported.`

Is there a way to do this?

---

<div class="post-metadata">

**Author:** ![Manuel](https://community.parseplatform.org/user_avatar/community.parseplatform.org/manuel/32/186_2.png) [@Manuel](https://community.parseplatform.org/u/Manuel)\
**Post date:** [January 23, 2022, 11:22am UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/2 "2022-01-23T11:22:10Z")

</div>

The field `authData` does not actually exist in the DB, it is synthesized from the `_auth_data_*` fields in the DB, so direct manipulation does not work in all cases.

The correct way to delete authData is to either call `ParseUser.unlink` or via REST call:

```auto
body: {
    "authData": {
        "facebook": null
    }
}

```

Your expectation seems valid and intuitive, so Parse Server should probably interpret a request to set `authData` to null correctly as removing all authData entries. You could also try to `unset` the `authData` field, not sure if that works.

---

<div class="post-metadata">

**Author:** ![Moumouls](https://community.parseplatform.org/user_avatar/community.parseplatform.org/moumouls/32/332_2.png) [@Moumouls](https://community.parseplatform.org/u/Moumouls)\
**Post date:** [February 5, 2022, 11:59am UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/3 "2022-02-05T11:59:53Z")

</div>

Hi @rhuanbarreto in Parse V5, you issue will be easy to solve.

I’ve worked on a new Auth Adapter system, and will be possible to control data saved/returned at login/register time ! [https://github.com/parse-community/parse-server/pull/7079](https://github.com/parse-community/parse-server/pull/7079)

You are right in many uses case if you do not need the 3rd party token to query 3rd party data; it’s a best practice to do not store these tokens.

---

<div class="post-metadata">

**Author:** ![rhuanbarreto](https://community.parseplatform.org/user_avatar/community.parseplatform.org/rhuanbarreto/32/151_2.png) [@rhuanbarreto](https://community.parseplatform.org/u/rhuanbarreto)\
**Post date:** [May 4, 2022, 7:17am UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/4 "2022-05-04T07:17:13Z")

</div>

Amazing Job you did!

But it’s not clear in your PR how to do such thing. Did you make a PR for docs as well?

---

<div class="post-metadata">

**Author:** ![Moumouls](https://community.parseplatform.org/user_avatar/community.parseplatform.org/moumouls/32/332_2.png) [@Moumouls](https://community.parseplatform.org/u/Moumouls)\
**Post date:** [May 4, 2022, 8:56am UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/5 "2022-05-04T08:56:27Z")

</div>

I @rhuanbarreto

With new handles like `validateLogin/validateSignup` or even with the `validateAuthData`

These functions will now be able to return an object that helps the parse-server know what to do with authData.

Ex:

```auto
async validateAuthData(authData){
   const id = authData.id
   // Do your validation stuff
   await validateToken(authData.token)
   return {
     // Only save the id into the DB
     save: { id }
     // Response object will be available on the login response under `authDataResponse`
     // Parse.User.get(‘authDataResponse’).myLoginProvider.message (for example)
     // this is optional
     response: { message: “Welcome back” }
   }
}

```

Also if you want to prevent authData to be updated on an already existing user

```auto
async validateLogin(authData){
   const id = authData.id
   // Do your validation stuff
   await validateToken(authData.token)
   return {
     // Parse Server will not update authData
     // By default Parse always update authData after login/signUp with the new fresh provided authData
     // If you implement a custom Auth Provider like an email/password, it could be useful to avoid Parse Server
     // to update the hashed password with the clear password provided at login time
     doNotSave: true
   }
}

```

---

<div class="post-metadata">

**Author:** ![rhuanbarreto](https://community.parseplatform.org/user_avatar/community.parseplatform.org/rhuanbarreto/32/151_2.png) [@rhuanbarreto](https://community.parseplatform.org/u/rhuanbarreto)\
**Post date:** [May 6, 2022, 3:30pm UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/6 "2022-05-06T15:30:37Z")

</div>

So the only thing is when this is going to be released! Looking forward to update parse in order to use it!

---

<div class="post-metadata">

**Author:** ![Moumouls](https://community.parseplatform.org/user_avatar/community.parseplatform.org/moumouls/32/332_2.png) [@Moumouls](https://community.parseplatform.org/u/Moumouls)\
**Post date:** [May 7, 2022, 3:13pm UTC](https://community.parseplatform.org/t/remove-sensitive-data-from-authdata/2377/7 "2022-05-07T15:13:45Z")

</div>

Yes @rhuanbarreto the PR is quite active: [feat: new auth adapter and webauthn by Moumouls · Pull Request #7079 · parse-community/parse-server · GitHub](https://github.com/parse-community/parse-server/pull/7079#issuecomment-1119692181)

We need a last review check from other maintainers and this feature should be available under Parse Server 5.X.

Then I’ll be happy to get your feedback on this new feature to improve your app security 🚀