parse-server icon indicating copy to clipboard operation
parse-server copied to clipboard

fix: Deny requests for ip restricted master keys

Open suathh opened this issue 2 years ago • 6 comments

Pull Request

Issue

Closes: #8829

Approach

Tasks

  • [ ] Add tests
  • [ ] Add changes to documentation (guides, repository pages, code comments)
  • [ ] Add security check
  • [ ] Add new Parse Error codes to Parse JS SDK

suathh avatar Dec 11 '23 11:12 suathh

Thanks for opening this pull request!

@suathh Tests are failing, could you please take a look?

mtrezza avatar Dec 13 '23 01:12 mtrezza

I will reformat the title to use the proper commit message syntax.

@mtrezza Most of the fails are because of the update we are doing.

The test fails with these lines

  • Error: Access denied: IP address '127.0.0.1' is not authorized to use the master key.

Denial of Master Key 2 Denial of Master Key

But one test has a different problem which is the Node v14 test, it is timeout for live query

Timeout

suathh avatar Jan 02 '24 09:01 suathh

What do you suggest as solution?

mtrezza avatar Jan 02 '24 11:01 mtrezza

At this point, I need to check what those failing tests stand for and what they are doing. It would be better to take advice or help from the test creators or someone who knows what they stand for.

But as an oversight, what I see from error logs;

  1. We need to add local IP addresses to our Parse-Server config for our tests. In this case 127.0.0.1 but that won't work if the test env running on an IPv6 env.
  2. Update the tests according to our breaking change
  3. Remove the failing tests cause they are trying to test a breaking change but this will eventually lead to step 2

suathh avatar Jan 02 '24 13:01 suathh

I have fixed the test cases that were related to this current change, there are still more failed tests are exist but they are unrelated to this change, please give me Write access to this pull request so I can push my commit @suathh @mtrezza

EhsanParsania avatar Feb 23 '24 09:02 EhsanParsania

Superseded by https://github.com/parse-community/parse-server/pull/8957

mtrezza avatar Mar 23 '24 23:03 mtrezza