joe/kami-parse-server
Public Access
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Don't require all keys to be configured to enable key checks (#2816) (#2941)

Browse Source 
* Add tests. Fail request if any of the 4 optional keys does not match

* Only require one key to be supplied in the request, except when no keys are configured

* Use const over let, var
This commit is contained in:
Steven Shipton
2016-10-26 21:44:39 +01:00
committed by Florent Vilmart
parent 278027a955
commit e788d49af0
2 changed files with 62 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
src/middlewares.js
View File

@@ -120,20 +120,15 @@ export function handleParseHeaders(req, res, next) {
// Client keys are not required in parse-server, but if any have been configured in the server, validate them
// to preserve original behavior.
let keys = ["clientKey", "javascriptKey", "dotNetKey", "restAPIKey"];
const keys = ["clientKey", "javascriptKey", "dotNetKey", "restAPIKey"];
const oneKeyConfigured = keys.some(function(key) {
return req.config[key];
});
const oneKeyMatches = keys.some(function(key){
return req.config[key] && info[key] == req.config[key];
});
// We do it with mismatching keys to support no-keys config
var keyMismatch = keys.reduce(function(mismatch, key){
// check if set in the config and compare
if (req.config[key] && info[key] !== req.config[key]) {
mismatch++;
}
return mismatch;
}, 0);
// All keys mismatch
if (keyMismatch == keys.length) {
if (oneKeyConfigured && !oneKeyMatches) {
return invalidRequest(req, res);
}