feat: Allow `Parse.Session.current` on expired session token instead of throwing error #8722

dplewis · 2023-08-30T17:52:05Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

In the current implementation, Parse.Session.current() throws an error with Session Expired message instead of letting us validate with getting the current session and check if it is valid.

Developers can place the logic of re-login into catch statement checking error code 209.

Closes: #8726

Approach

This PR bypasses the sessionToken check for /session/me endpoint.

Add tests

codecov · 2023-08-30T18:00:21Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Comparison is base (a22dbe1) 94.19% compared to head (2f4211f) 94.21%.
Report is 1 commits behind head on alpha.

Additional details and impacted files

@@            Coverage Diff             @@
##            alpha    #8722      +/-   ##
==========================================
+ Coverage   94.19%   94.21%   +0.01%     
==========================================
  Files         186      186              
  Lines       14819    14819              
==========================================
+ Hits        13959    13961       +2     
+ Misses        860      858       -2

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

parse-github-assistant · 2023-08-30T18:02:02Z

Thanks for opening this pull request!

mtrezza · 2023-08-30T21:18:58Z

A PR can only be linked to an issue in the same repository. Can I move the JS SDK issue to this repository?

dplewis · 2023-08-30T21:28:27Z

Go for it

mtrezza · 2023-08-30T22:58:41Z

In the current implementation, Parse.Session.current() throws an error with Session Expired message instead of letting us validate with getting the current session and check if it is valid.

Could this PR be a breaking change?

dplewis · 2023-08-31T00:47:23Z

Could this PR be a breaking change?

It could be, if developers checked for both expiresAt and error this should be good. If they checked for only session token expires error and not the expiresAt date this would be breaking for them since the error is no longer thrown.

mtrezza · 2023-08-31T00:59:34Z

In that case we can either introduce a temporary Parse Server option and deprecate it, or merge this PR in November for release with Parse Server 7, which may be easier.

dplewis · 2023-08-31T01:00:52Z

Waiting for the next release is better.

mtrezza

Looks good, waiting for merge in Nov for next major release.

mtrezza · 2023-12-25T19:34:30Z

Suggested breaking change text:

Parse.Session.current() no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity.

# [7.0.0-alpha.3](7.0.0-alpha.2...7.0.0-alpha.3) (2023-12-26) ### Bug Fixes * Conditional email verification not working in some cases if `verifyUserEmails`, `preventLoginWithUnverifiedEmail` set to functions ([#8838](#8838)) ([8e7a6b1](8e7a6b1)) ### Features * Allow `Parse.Session.current` on expired session token instead of throwing error ([#8722](#8722)) ([f9dde4a](f9dde4a)) ### BREAKING CHANGES * `Parse.Session.current()` no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity ([f9dde4a](f9dde4a))

parseplatformorg · 2023-12-26T23:59:27Z

🎉 This change has been released in version 7.0.0-alpha.3

# [7.0.0-beta.1](6.5.0-beta.1...7.0.0-beta.1) (2024-03-19) ### Bug Fixes * CacheAdapter does not connect when using a CacheAdapter with a JSON config ([#8633](#8633)) ([720d24e](720d24e)) * Conditional email verification not working in some cases if `verifyUserEmails`, `preventLoginWithUnverifiedEmail` set to functions ([#8838](#8838)) ([8e7a6b1](8e7a6b1)) * Deny request if master key is not set in Parse Server option `masterKeyIps` regardless of ACL and CLP ([#8957](#8957)) ([a7b5b38](a7b5b38)) * Docker image not published to Docker Hub on new release ([#8905](#8905)) ([a2ac8d1](a2ac8d1)) * Docker version releases by removing arm/v6 and arm/v7 support ([#8976](#8976)) ([1f62dd0](1f62dd0)) * GraphQL file upload fails in case of use of pointer or relation ([#8721](#8721)) ([1aba638](1aba638)) * Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database ([#8961](#8961)) ([cbefe77](cbefe77)) * Incomplete user object in `verifyEmail` function if both username and email are changed ([#8889](#8889)) ([1eb95ae](1eb95ae)) * Parse Server option `emailVerifyTokenReuseIfValid: true` generates new token on every email verification request ([#8885](#8885)) ([0023ce4](0023ce4)) * Parse Server option `fileExtensions` default value rejects file extensions that are less than 3 or more than 4 characters long ([#8699](#8699)) ([2760381](2760381)) * Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability [GHSA-6hh7-46r2-vf29](GHSA-6hh7-46r2-vf29) ([#9024](#9024)) ([9f6e342](9f6e342)) * Server crashes when receiving an array of `Parse.Pointer` in the request body ([#8784](#8784)) ([66e3603](66e3603)) * Username is `undefined` in email verification link on email change ([#8887](#8887)) ([e315c13](e315c13)) ### Features * Add `installationId` to arguments for `verifyUserEmails`, `preventLoginWithUnverifiedEmail` ([#8836](#8836)) ([a22dbe1](a22dbe1)) * Add `installationId`, `ip`, `resendRequest` to arguments passed to `verifyUserEmails` on verification email request ([#8873](#8873)) ([8adcbee](8adcbee)) * Add `Parse.User` as function parameter to Parse Server options `verifyUserEmails`, `preventLoginWithUnverifiedEmail` on login ([#8850](#8850)) ([972f630](972f630)) * Add password validation via POST request for user with unverified email using master key and option `ignoreEmailVerification` ([#8895](#8895)) ([633a9d2](633a9d2)) * Add support for MongoDB 7 ([#8761](#8761)) ([3de8494](3de8494)) * Add support for MongoDB query comment ([#8928](#8928)) ([2170962](2170962)) * Add support for Node 20, drop support for Node 14, 16 ([#8907](#8907)) ([ced4872](ced4872)) * Add support for Postgres 16 ([#8898](#8898)) ([99489b2](99489b2)) * Allow `Parse.Session.current` on expired session token instead of throwing error ([#8722](#8722)) ([f9dde4a](f9dde4a)) * Deprecation DEPPS5: Config option `allowClientClassCreation` defaults to `false` ([#8849](#8849)) ([29624e0](29624e0)) * Deprecation DEPPS6: Authentication adapters disabled by default ([#8858](#8858)) ([0cf58eb](0cf58eb)) * Deprecation DEPPS7: Remove deprecated Cloud Code file trigger syntax ([#8855](#8855)) ([4e6a375](4e6a375)) * Deprecation DEPPS8: Parse Server option `allowExpiredAuthDataToken` defaults to `false` ([#8860](#8860)) ([e29845f](e29845f)) * Deprecation DEPPS9: LiveQuery `fields` option is renamed to `keys` ([#8852](#8852)) ([38983e8](38983e8)) * Node process exits with error code 1 on uncaught exception to allow custom uncaught exception handling ([#8894](#8894)) ([70c280c](70c280c)) * Switch GraphQL server from Yoga v2 to Apollo v4 ([#8959](#8959)) ([105ae7c](105ae7c)) * Upgrade Parse Server Push Adapter to 5.0.2 ([#8813](#8813)) ([6ef1986](6ef1986)) * Upgrade to Parse JS SDK 5 ([#9022](#9022)) ([ad4aa83](ad4aa83)) ### Performance Improvements * Improved IP validation performance for `masterKeyIPs`, `maintenanceKeyIPs` ([#8510](#8510)) ([b87daba](b87daba)) ### BREAKING CHANGES * The Parse Server option `allowClientClassCreation` defaults to `false`. ([29624e0](29624e0)) * A request using the master key will now be rejected as unauthorized if the IP from which the request originates is not set in the Parse Server option `masterKeyIps`, even if the request does not require the master key permission, for example for a public object in a public class class. ([a7b5b38](a7b5b38)) * Node process now exits with code 1 on uncaught exceptions, enabling custom handlers that were blocked by Parse Server's default behavior of re-throwing errors. This change may lead to automatic process restarts by the environment, unlike before. ([70c280c](70c280c)) * Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option `auth.<provider>.enabled: true` ([0cf58eb](0cf58eb)) * Parse Server option `allowExpiredAuthDataToken` defaults to `false`; a 3rd party authentication token will be validated every time the user tries to log in and the login will fail if the token has expired; the effect of this change may differ for different authentication adapters, depending on the token lifetime and the token refresh logic of the adapter ([e29845f](e29845f)) * LiveQuery `fields` option is renamed to `keys` ([38983e8](38983e8)) * Cloud Code file trigger syntax has been aligned with object trigger syntax, for example `Parse.Cloud.beforeDeleteFile'` has been changed to `Parse.Cloud.beforeDelete(Parse.File, (request) => {})'` ([4e6a375](4e6a375)) * Removes support for Node 14 and 16 ([ced4872](ced4872)) * Removes support for Postgres 11 and 12 ([99489b2](99489b2)) * The `Parse.User` passed as argument if `verifyUserEmails` is set to a function is renamed from `user` to `object` for consistency with invocations of `verifyUserEmails` on signup or login; the user object is not a plain JavaScript object anymore but an instance of `Parse.User` ([8adcbee](8adcbee)) * `Parse.Session.current()` no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity ([f9dde4a](f9dde4a)) * `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use. ([3de8494](3de8494))

parseplatformorg · 2024-03-19T18:33:19Z

🎉 This change has been released in version 7.0.0-beta.1

# [7.0.0](6.4.0...7.0.0) (2024-03-19) ### Bug Fixes * CacheAdapter does not connect when using a CacheAdapter with a JSON config ([#8633](#8633)) ([720d24e](720d24e)) * Conditional email verification not working in some cases if `verifyUserEmails`, `preventLoginWithUnverifiedEmail` set to functions ([#8838](#8838)) ([8e7a6b1](8e7a6b1)) * Context not passed to Cloud Code Trigger `beforeFind` when using `Parse.Query.include` ([#8765](#8765)) ([7d32d89](7d32d89)) * Deny request if master key is not set in Parse Server option `masterKeyIps` regardless of ACL and CLP ([#8957](#8957)) ([a7b5b38](a7b5b38)) * Docker image not published to Docker Hub on new release ([#8905](#8905)) ([a2ac8d1](a2ac8d1)) * Docker version releases by removing arm/v6 and arm/v7 support ([#8976](#8976)) ([1f62dd0](1f62dd0)) * GraphQL file upload fails in case of use of pointer or relation ([#8721](#8721)) ([1aba638](1aba638)) * Improve PostgreSQL injection detection; fixes security vulnerability [GHSA-6927-3vr9-fxf2](GHSA-6927-3vr9-fxf2) which affects Parse Server deployments using a Postgres database ([#8961](#8961)) ([cbefe77](cbefe77)) * Incomplete user object in `verifyEmail` function if both username and email are changed ([#8889](#8889)) ([1eb95ae](1eb95ae)) * Parse Server option `emailVerifyTokenReuseIfValid: true` generates new token on every email verification request ([#8885](#8885)) ([0023ce4](0023ce4)) * Parse Server option `fileExtensions` default value rejects file extensions that are less than 3 or more than 4 characters long ([#8699](#8699)) ([2760381](2760381)) * Parse Server option `fileUpload.fileExtensions` fails to determine file extension if filename contains multiple dots ([#8754](#8754)) ([3d6d50e](3d6d50e)) * Security bump @babel/traverse from 7.20.5 to 7.23.2 ([#8777](#8777)) ([2d6b3d1](2d6b3d1)) * Security upgrade graphql from 16.6.0 to 16.8.1 ([#8758](#8758)) ([71dfd8a](71dfd8a)) * Server crashes on invalid Cloud Function or Cloud Job name; fixes security vulnerability [GHSA-6hh7-46r2-vf29](GHSA-6hh7-46r2-vf29) ([#9024](#9024)) ([9f6e342](9f6e342)) * Server crashes when receiving an array of `Parse.Pointer` in the request body ([#8784](#8784)) ([66e3603](66e3603)) * Username is `undefined` in email verification link on email change ([#8887](#8887)) ([e315c13](e315c13)) ### Features * Add `$setOnInsert` operator to `Parse.Server.database.update` ([#8791](#8791)) ([f630a45](f630a45)) * Add `installationId` to arguments for `verifyUserEmails`, `preventLoginWithUnverifiedEmail` ([#8836](#8836)) ([a22dbe1](a22dbe1)) * Add `installationId`, `ip`, `resendRequest` to arguments passed to `verifyUserEmails` on verification email request ([#8873](#8873)) ([8adcbee](8adcbee)) * Add `Parse.User` as function parameter to Parse Server options `verifyUserEmails`, `preventLoginWithUnverifiedEmail` on login ([#8850](#8850)) ([972f630](972f630)) * Add compatibility for MongoDB Atlas Serverless and AWS Amazon DocumentDB with collation options `enableCollationCaseComparison`, `transformEmailToLowercase`, `transformUsernameToLowercase` ([#8805](#8805)) ([09fbeeb](09fbeeb)) * Add context to Cloud Code Triggers `beforeLogin` and `afterLogin` ([#8724](#8724)) ([a9c34ef](a9c34ef)) * Add password validation via POST request for user with unverified email using master key and option `ignoreEmailVerification` ([#8895](#8895)) ([633a9d2](633a9d2)) * Add support for MongoDB 7 ([#8761](#8761)) ([3de8494](3de8494)) * Add support for MongoDB query comment ([#8928](#8928)) ([2170962](2170962)) * Add support for Node 20, drop support for Node 14, 16 ([#8907](#8907)) ([ced4872](ced4872)) * Add support for Postgres 16 ([#8898](#8898)) ([99489b2](99489b2)) * Allow `Parse.Session.current` on expired session token instead of throwing error ([#8722](#8722)) ([f9dde4a](f9dde4a)) * Allow setting `createdAt` and `updatedAt` during `Parse.Object` creation with maintenance key ([#8696](#8696)) ([77bbfb3](77bbfb3)) * Deprecation DEPPS5: Config option `allowClientClassCreation` defaults to `false` ([#8849](#8849)) ([29624e0](29624e0)) * Deprecation DEPPS6: Authentication adapters disabled by default ([#8858](#8858)) ([0cf58eb](0cf58eb)) * Deprecation DEPPS7: Remove deprecated Cloud Code file trigger syntax ([#8855](#8855)) ([4e6a375](4e6a375)) * Deprecation DEPPS8: Parse Server option `allowExpiredAuthDataToken` defaults to `false` ([#8860](#8860)) ([e29845f](e29845f)) * Deprecation DEPPS9: LiveQuery `fields` option is renamed to `keys` ([#8852](#8852)) ([38983e8](38983e8)) * Node process exits with error code 1 on uncaught exception to allow custom uncaught exception handling ([#8894](#8894)) ([70c280c](70c280c)) * Switch GraphQL server from Yoga v2 to Apollo v4 ([#8959](#8959)) ([105ae7c](105ae7c)) * Upgrade Parse Server Push Adapter to 5.0.2 ([#8813](#8813)) ([6ef1986](6ef1986)) * Upgrade to Parse JS SDK 5 ([#9022](#9022)) ([ad4aa83](ad4aa83)) ### Performance Improvements * Improved IP validation performance for `masterKeyIPs`, `maintenanceKeyIPs` ([#8510](#8510)) ([b87daba](b87daba)) ### BREAKING CHANGES * The Parse Server option `allowClientClassCreation` defaults to `false`. ([29624e0](29624e0)) * A request using the master key will now be rejected as unauthorized if the IP from which the request originates is not set in the Parse Server option `masterKeyIps`, even if the request does not require the master key permission, for example for a public object in a public class class. ([a7b5b38](a7b5b38)) * Node process now exits with code 1 on uncaught exceptions, enabling custom handlers that were blocked by Parse Server's default behavior of re-throwing errors. This change may lead to automatic process restarts by the environment, unlike before. ([70c280c](70c280c)) * Authentication adapters are disabled by default; to use an authentication adapter it needs to be explicitly enabled in the Parse Server authentication adapter option `auth.<provider>.enabled: true` ([0cf58eb](0cf58eb)) * Parse Server option `allowExpiredAuthDataToken` defaults to `false`; a 3rd party authentication token will be validated every time the user tries to log in and the login will fail if the token has expired; the effect of this change may differ for different authentication adapters, depending on the token lifetime and the token refresh logic of the adapter ([e29845f](e29845f)) * LiveQuery `fields` option is renamed to `keys` ([38983e8](38983e8)) * Cloud Code file trigger syntax has been aligned with object trigger syntax, for example `Parse.Cloud.beforeDeleteFile'` has been changed to `Parse.Cloud.beforeDelete(Parse.File, (request) => {})'` ([4e6a375](4e6a375)) * Removes support for Node 14 and 16 ([ced4872](ced4872)) * Removes support for Postgres 11 and 12 ([99489b2](99489b2)) * The `Parse.User` passed as argument if `verifyUserEmails` is set to a function is renamed from `user` to `object` for consistency with invocations of `verifyUserEmails` on signup or login; the user object is not a plain JavaScript object anymore but an instance of `Parse.User` ([8adcbee](8adcbee)) * `Parse.Session.current()` no longer throws an error if the session token is expired, but instead returns the session token with its expiration date to allow checking its validity ([f9dde4a](f9dde4a)) * `Parse.Query` no longer supports the BSON type `code`; although this feature was never officially documented, its removal is announced as a breaking change to protect deployments where it might be in use. ([3de8494](3de8494))

parseplatformorg · 2024-03-19T20:50:08Z

🎉 This change has been released in version 7.0.0

feat: Allow Parse.Session.current on expired session token

c5f39b7

dplewis requested a review from mtrezza August 30, 2023 17:53

dplewis mentioned this pull request Aug 30, 2023

Retrieve Session Expiration details during Login #8726

Closed

3 tasks

mtrezza added the state:breaking Breaking change requires major version increment and `BREAKING CHANGE` commit message label Aug 31, 2023

mtrezza added the block:major Needs to be resolved before next major release; remove label afterwards label Sep 2, 2023

This comment was marked as resolved.

Sign in to view

parse-github-assistant bot removed the block:major Needs to be resolved before next major release; remove label afterwards label Sep 2, 2023

dplewis mentioned this pull request Sep 3, 2023

feat: Allow logout with invalid session token parse-community/Parse-SDK-JS#1803

Open

1 task

Merge branch 'alpha' into session-expires

17e9adf

mtrezza approved these changes Sep 7, 2023

View reviewed changes

Merge branch 'alpha' into session-expires

2f4211f

mtrezza changed the title ~~feat: Allow Parse.Session.current on expired session token~~ feat: Allow Parse.Session.current on expired session token instead of throwing error Dec 25, 2023

mtrezza merged commit f9dde4a into parse-community:alpha Dec 25, 2023
28 of 29 checks passed

parseplatformorg added the state:released-alpha Released as alpha version label Dec 26, 2023

parseplatformorg added the state:released-beta Released as beta version label Mar 19, 2024

parseplatformorg added the state:released Released as stable version label Mar 19, 2024

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat: Allow `Parse.Session.current` on expired session token instead of throwing error #8722

feat: Allow `Parse.Session.current` on expired session token instead of throwing error #8722

dplewis commented Aug 30, 2023

codecov bot commented Aug 30, 2023 •

edited

Loading

parse-github-assistant bot commented Aug 30, 2023

mtrezza commented Aug 30, 2023 •

edited

Loading

dplewis commented Aug 30, 2023

mtrezza commented Aug 30, 2023 •

edited

Loading

dplewis commented Aug 31, 2023 •

edited

Loading

mtrezza commented Aug 31, 2023 •

edited

Loading

dplewis commented Aug 31, 2023

This comment was marked as resolved.

mtrezza left a comment •

edited

Loading

mtrezza commented Dec 25, 2023 •

edited

Loading

parseplatformorg commented Dec 26, 2023

parseplatformorg commented Mar 19, 2024

parseplatformorg commented Mar 19, 2024

feat: Allow Parse.Session.current on expired session token instead of throwing error #8722

feat: Allow Parse.Session.current on expired session token instead of throwing error #8722

Conversation

dplewis commented Aug 30, 2023

Pull Request

Issue

Approach

codecov bot commented Aug 30, 2023 • edited Loading

Codecov Report

parse-github-assistant bot commented Aug 30, 2023

Thanks for opening this pull request!

mtrezza commented Aug 30, 2023 • edited Loading

dplewis commented Aug 30, 2023

mtrezza commented Aug 30, 2023 • edited Loading

dplewis commented Aug 31, 2023 • edited Loading

mtrezza commented Aug 31, 2023 • edited Loading

dplewis commented Aug 31, 2023

This comment was marked as resolved.

mtrezza left a comment • edited Loading

Choose a reason for hiding this comment

mtrezza commented Dec 25, 2023 • edited Loading

parseplatformorg commented Dec 26, 2023

parseplatformorg commented Mar 19, 2024

parseplatformorg commented Mar 19, 2024

feat: Allow `Parse.Session.current` on expired session token instead of throwing error #8722

feat: Allow `Parse.Session.current` on expired session token instead of throwing error #8722

codecov bot commented Aug 30, 2023 •

edited

Loading

mtrezza commented Aug 30, 2023 •

edited

Loading

mtrezza commented Aug 30, 2023 •

edited

Loading

dplewis commented Aug 31, 2023 •

edited

Loading

mtrezza commented Aug 31, 2023 •

edited

Loading

mtrezza left a comment •

edited

Loading

mtrezza commented Dec 25, 2023 •

edited

Loading