Repository navigation
Improve default Parse.User security #7292
Description
New Feature / Enhancement Checklist
- I am not disclosing a vulnerability.
- I am not just asking a question.
- I have searched through existing issues.
Current Limitation
By default, when a new user is created, it will have public R, unless overriden by a cloud function.
Feature / Enhancement Description
Currently, to secure users, you need to create a cloud function. In my view, the reverse should be the case - that by default, the Parse.User ACL is R+W false, and if you want the "old" functionality, you should use a cloud function.
The changelog would be:
Breaking Change: Parse.User now defaults to public R false on signup. To achieve public read on sign up, use a cloud trigger:
Parse.Cloud.beforeSave(Parse.User, ({object}) => {
if (!object.existed()) {
const acl = new Parse.ACL();
object.setPublicReadAccess(true);
object.setACL(acl);
}
});Alternatives / Workarounds
Create a cloud function to prevent public R access on signup. It's my view this should be reversed - a cloud function shouldn't be needed to secure the user class.
Activity
mtrezza commentedon Mar 22, 2021
Thanks for suggesting.
From a security perspective we want to move towards a strict default, so your suggestion to change the default makes sense.
As we are moving towards phased depreciation, before this would become a breaking change, the following would need to be implemented:
dblythy commentedon Mar 24, 2021
Awesome, thanks for the detailed write up. This will be a good way to show the depreciation policy, considering it will only change a few lines of code. I’ll submit a PR shortly.
dblythy commentedon Oct 8, 2021
Closed via #7319. On master, if you set
enforcePrivateUserstotrue, users ACL won't have public read on signup.