fix: Authentication provider credentials are usable across Parse Server apps; fixes security vulnerability [GHSA-837q-jhwx-cmpv](https://github.com/parse-community/parse-server/security/advisories/GHSA-837q-jhwx-cmpv) (#9667)
This commit is contained in:
@@ -69,6 +69,17 @@ class CheckGroupServerConfig extends CheckGroup {
|
||||
}
|
||||
},
|
||||
}),
|
||||
new Check({
|
||||
title: 'Insecure auth adapters disabled',
|
||||
warning:
|
||||
"Attackers may explore insecure auth adapters' vulnerabilities and log in on behalf of another user.",
|
||||
solution: "Change Parse Server configuration to 'enableInsecureAuthAdapters: false'.",
|
||||
check: () => {
|
||||
if (config.enableInsecureAuthAdapters !== false) {
|
||||
throw 1;
|
||||
}
|
||||
},
|
||||
}),
|
||||
];
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user