fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv) (#9668)
This commit is contained in:
@@ -1,3 +1,47 @@
|
||||
/**
|
||||
* Parse Server authentication adapter for Google.
|
||||
*
|
||||
* @class GoogleAdapter
|
||||
* @param {Object} options - The adapter configuration options.
|
||||
* @param {string} options.clientId - Your Google application Client ID. Required for authentication.
|
||||
*
|
||||
* @description
|
||||
* ## Parse Server Configuration
|
||||
* To configure Parse Server for Google authentication, use the following structure:
|
||||
* ```json
|
||||
* {
|
||||
* "auth": {
|
||||
* "google": {
|
||||
* "clientId": "your-client-id"
|
||||
* }
|
||||
* }
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* The adapter requires the following `authData` fields:
|
||||
* - **id**: The Google user ID.
|
||||
* - **id_token**: The Google ID token.
|
||||
* - **access_token**: The Google access token.
|
||||
*
|
||||
* ## Auth Payload
|
||||
* ### Example Auth Data Payload
|
||||
* ```json
|
||||
* {
|
||||
* "google": {
|
||||
* "id": "1234567",
|
||||
* "id_token": "xxxxx.yyyyy.zzzzz",
|
||||
* "access_token": "abc123def456ghi789"
|
||||
* }
|
||||
* }
|
||||
* ```
|
||||
*
|
||||
* ## Notes
|
||||
* - Ensure your Google Client ID is configured properly in the Parse Server configuration.
|
||||
* - The `id_token` and `access_token` are validated against Google's authentication services.
|
||||
*
|
||||
* @see {@link https://developers.google.com/identity/sign-in/web/backend-auth Google Authentication Documentation}
|
||||
*/
|
||||
|
||||
'use strict';
|
||||
|
||||
// Helper functions for accessing the google API.
|
||||
|
||||
Reference in New Issue
Block a user