Commit Graph

58 Commits

Author SHA1 Message Date
dblythy
5bbf9cade9 feat: Improve authentication adapter interface to support multi-factor authentication (MFA), authentication challenges, and provide a more powerful interface for writing custom authentication adapters (#8156) 2022-11-10 17:35:39 +01:00
Manuel
ecf0814499 fix: authentication adapter app ID validation may be circumvented; this fixes a vulnerability that affects configurations which allow users to authenticate using the Parse Server authentication adapter for *Facebook* or *Spotify* and where the server-side authentication adapter configuration appIds is set as a string (e.g. abc) instead of an array of strings (e.g. ["abc"]) ([GHSA-r657-33vp-gp22](https://github.com/parse-community/parse-server/security/advisories/GHSA-r657-33vp-gp22)) (#8185) 2022-09-20 22:31:19 +02:00
Manuel
ba2b0a9cb9 fix: certificate in Apple Game Center auth adapter not validated; this fixes a security vulnerability in which authentication could be bypassed using a fake certificate; if you are using the Apple Gamer Center auth adapter it is your responsibility to keep its root certificate up-to-date and we advice you read the security advisory ([GHSA-rh9j-f5f8-rvgc](https://github.com/parse-community/parse-server/security/advisories/GHSA-rh9j-f5f8-rvgc)) 2022-06-17 18:29:26 +02:00
Manuel
af4a0417a9 fix: authentication bypass and denial of service (DoS) vulnerabilities in Apple Game Center auth adapter (GHSA-qf8x-vqjv-92gr) (#7962) 2022-05-01 02:28:16 +02:00
Manuel Trezza
1593575a87 build: release 2022-03-18 15:17:12 +01:00
Corey
a5ffb95022 refactor: remove deprecated url.parse() method (#7751) 2022-01-06 15:26:00 +01:00
Diamond Lewis
a02014f557 Improve single schema cache (#7214)
* Initial Commit

* fix flaky test

* temporary set ci timeout

* turn off ci check

* fix postgres tests

* fix tests

* node flaky test

* remove improvements

* Update SchemaPerformance.spec.js

* fix tests

* revert ci

* Create Singleton Object

* properly clear cache testing

* Cleanup

* remove fit

* try PushController.spec

* try push test rewrite

* try push enqueue time

* Increase test timeout

* remove pg server creation test

* xit push tests

* more xit

* remove skipped tests

* Fix conflicts

* reduce ci timeout

* fix push tests

* Revert "fix push tests"

This reverts commit 05aba62f1cbbca7d5d3e80b9444529f59407cb56.

* improve initialization

* fix flaky tests

* xit flaky test

* Update CHANGELOG.md

* enable debug logs

* Update LogsRouter.spec.js

* create initial indexes in series

* lint

* horizontal scaling documentation

* Update Changelog

* change horizontalScaling db option

* Add enableSchemaHooks option

* move enableSchemaHooks to databaseOptions
2021-03-16 16:05:36 -05:00
Diamond Lewis
1666c3e382 [WIP] Enable test suite to be randomized (#7265)
* initial run

* Update ParseGraphQLServer.spec.js

* temporarily enable reporter

* Bump retry limit

* fix undefined database

* try to catch error

* Handle LiveQueryServers

* Update Config.js

* fast-fail false

* Remove usage of AppCache

* oops

* Update contributing guide

* enable debugger, try network retry attempt 1

* Fix ldap unbinding

* move non specs to support

* add missing mock adapter

* fix Parse.Push

* RestController should match batch.spec.js

* Remove request attempt limit

* handle index.spec.js

* Update CHANGELOG.md

* Handle error: tuple concurrently updated

* test transactions

* Clear RedisCache after every test

* LoggerController.spec.js

* Update schemas.spec.js

* finally fix transactions

* fix geopoint deadlock

* transaction with clean database

* batch.spec.js
2021-03-15 02:04:09 -05:00
Miguel Serrano
92f50f6808 Add support for Facebook Limited Login (#7219)
* Add support for Facebook Limited auth

* Add tests

* Fix tests

* Fix tests

* Add entry to changelog

* Cleanup
2021-02-24 07:36:24 -06:00
OverDrive
a1cd631425 Fix for authenticating with instagram (#7173)
* Fix for authenticating with instagram

* Change tests for instagram authentication

* Instagram authentication for the case when data child object is presented in the response
2021-02-19 13:19:13 -06:00
Diamond Lewis
033a0bd443 Fix Prettier (#7066) 2020-12-13 11:19:04 -06:00
Antonio Davi Macedo Coelho de Castro
da905a357d Merge pull request from GHSA-4w46-w44m-3jq3
* strip password after authentication to prevent cleartext password storage

* fixed forgotten testcase forcing ;-/

* added test to check if password is not stored in user record

Co-authored-by: Fabian Strachanski <fabian@fastr.de>
2020-12-02 13:08:02 -08:00
Fabian Strachanski
c958c46fa7 Add LDAPS-support to LDAP-Authcontroller (#7014)
* Add LDAPS-support to LDAP-Authcontroller

* Add Testcase that failed with valid certificate but wrong credendtials to LDAP-Authcontroller

* change scope of 'error' and remove 'case undefined', because it's not needed anymore
2020-11-18 16:20:59 -08:00
Antonio Davi Macedo Coelho de Castro
755c612fd8 Update vkontakte API to the latest version (#6944)
* Update vkontakte API to the latest version

* Allow developers to set the api version (optional)
2020-10-15 15:24:36 -07:00
Kevin Kuang
9d836ee87b Use an empty object as default value of options for Google Sign in (#6844)
* Use an empty object as default value of options for Google Sign in

* add test case

* Update test case to specifically  for google auth
2020-10-14 20:17:10 -07:00
Antoine Cormouls
62048260c9 GraphQL: Optimize queries, fixes some null returns (on object), fix stitched GraphQLUpload (#6709)
* Optimize query, fixes some null returns, fix stitched GraphQLUpload

* Fix authData key selection

* Prefer Iso string since other GraphQL solutions use this format

* fix tests

Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-10-01 15:19:26 -07:00
timination
66f7af90c3 Hotfix instagram api (#6922)
* updated defaultURL to allow new insta API access

* updated defaultURL to allow new insta API access

* updates tests for new instagram API url

Co-authored-by: Tim Talbot <tim@dyingmethod.com>
2020-10-01 18:45:01 +02:00
Rhuan
6e36411ce7 Keycloak auth adapter (#6376)
* Copy auth adapter to create keycloak adapter

* Add keycloak authentication adapter

* Add keycloak to auth adapter tests

* Improve tests

Co-authored-by: Rhuan <rhuan@MacBook-Pro-de-Rhuan.local>
Co-authored-by: Diamond Lewis <findlewis@gmail.com>
Co-authored-by: Antonio Davi Macedo Coelho de Castro <adavimacedo@gmail.com>
2020-08-30 23:11:07 -07:00
Diamond Lewis
a0ac8e0686 Remove Facebook AccountKit auth (#6870)
* Remove Facebook AccountKit auth

Account Kit services are no longer available.

https://developers.facebook.com/blog/post/2019/09/09/account-kit-services-no-longer-available-starting-march/

https://www.sinch.com/blog/facebook-account-kit-is-closing-down-are-your-apps-covered/

* remove flaky test
2020-08-20 10:09:54 -07:00
Arjun Vedak
42f75d6d94 fix(auth): Properly handle google token issuer (#6836)
* Updated TOKEN_ISSUER to 'accounts.google.com'

Hi, I was getting this issue from today morning parse-server/Adapters/Auth/google.js was expecting the TOKEN_ISSUER to be prefixed with https:// but on debugging the original value was not having the prefix, removing https:// from TOKEN_ISSUER solved this bug. This issue is introduced in 4.3.0 as in 4.2.0 it is working fine currently I have downgraded the version to 4.2.0 for it to work properly and suggesting the changes please merge this PR.

* Update google.js

* Update AuthenticationAdapters.spec.js

* Update google.js

* Update google.js
2020-07-29 09:55:59 -05:00
SebC
cbf9da517b Add production Google Auth Adapter instead of using the development url (#6734)
* Add the production Google Auth Adapter instead of using the development url

* Update tests to the new google auth

* lint
2020-07-15 09:56:08 -07:00
Maravilho Singa
b60502d8a0 Instagram: Support passing in API url (#6398)
* Update instagram.js

Instagram API was updated.

* Update instagram.js

Instagram API was updated and is not allowing anymore to setup new projects to use the old style but it is still working for the ones that have it already setup.

New docs are listed here: https://developers.facebook.com/docs/instagram-basic-display-api/

I've added support for both old and new API
To use new API just add new field "api_type" = "new_api" in client side.

For old API just no changes needed.

* support api url

Co-authored-by: Diamond Lewis <findlewis@gmail.com>
2020-03-22 11:24:22 -05:00
UnderratedDev
dd2b64ef65 updated 2 files for allowing multiple client ids (#6523)
* updated 2 files for allowing multiple client ids

* updated tests that fail due to user inputting data in code, added todo comment to them stating what we need to do to fix them
2020-03-21 19:04:10 -05:00
Andy
8e0e485de1 use token and algo from jwt header (#6416)
* use token and algo from jwt header

* change node-rsa out for jwks-rsa, reflect change in tests and add one test for coverage

* remove superfluous cache, allow jwks cache parameters to be passed to validateAuthData

* remove package lock

* regenerate package lock

* try fixing package-lock with copy from master

* manual changes for merge conflict

* whitespace

* pass options as object

* fix inconsistent variable name
2020-03-11 15:29:20 -05:00
Diamond Lewis
985933955f Suppress Test Logs (#6256)
* Suppress Test Logs

This will reduce some of the noise in the tests logs.

* replace deprecated buffer

* remove deprecation warnings

* fix geopoint

* Fix GraphQL

* postgres warnings
2019-12-03 18:21:12 -06:00
Julian Dax
4435154cf9 Add LDAP auth module (#6226) 2019-11-25 10:03:38 -06:00
Diamond Lewis
a2d332f698 Fix #6179 Initializing default logger (#6186)
* Fix #6179 Initializing default logger

Fixes: #6179

Removes unnessary logs

* fix typo

* if error just write to console
2019-11-07 17:41:34 -06:00
Diamond Lewis
b44726987d Support Google Play Games Service (#6147)
* Support Google Play Games Service

* clean up

* improve coverage

* more tests
2019-10-28 13:16:55 -05:00
Diamond Lewis
c1a217c6b8 Support Apple Game Center Auth (#6143)
Fixes: https://github.com/parse-community/parse-server/issues/5984
2019-10-18 19:04:01 -05:00
Alann Maulana
38e0ff9d76 Microsoft Graph Authentication (#6051)
* add microsoft graph auth

* change mail to id

* add graph user id and email

* add microsoft graph auth test case

* remove validating auth data using mail

* add test case to AuthenticationAdapters

* fix indentation

* fix httpsRequest and fakeClaim not found

* add newline eof last

* fix test in auth adapter

* fix unhandled promise rejection
2019-09-26 13:23:18 -05:00
Saimoom Safayet Akash
723fe3b158 added support for line auth (#6007)
* added support for line auth

* fixed linting issues

* modified auth adapter spec to handle line auth adapter

* revert package.json changes
2019-09-03 08:11:33 -05:00
Diamond Lewis
cf6e79ee75 Fix: Lint no-prototype-builtins (#5920)
* Fix: Lint no-prototype-builtins

Closes: https://github.com/parse-community/parse-server/issues/5842

Reference: https://eslint.org/docs/rules/no-prototype-builtins

* replace Object.hasOwnProperty.call
2019-08-14 14:57:00 -07:00
SebC
b246bad5c7 Fix apple signin authAdapter (#5891)
* Fix apple signin authAdapter to use the user id instead of the user token

* Update spec
2019-08-07 18:08:14 -05:00
Ivan SZKIBA
dfe0ff753c support PhantAuth authentication (#5850)
* support PhantAuth authentication

* fix spelling issues

* Add test case
2019-07-29 00:58:43 -05:00
Antonio Davi Macedo Coelho de Castro
8a925177e1 Cache apple public key for the case it fails to fetch again (#5848) 2019-07-25 10:20:28 -07:00
Diamond Lewis
3a7b0c4c75 Fix: Linking with Apple Auth (#5755)
Rename from apple-signin to apple (key names can't have hyphens
Rename id_token to id (auth adapters require id)
2019-07-03 16:28:29 -05:00
Diamond Lewis
6385deeb6e Add AppSecret to Facebook Auth (#5695)
Closes: https://github.com/parse-community/parse-server/issues/5448
2019-06-20 14:15:57 -05:00
Diamond Lewis
fcdf2d7947 Sign in with Apple Auth Provider (#5694)
* Sign in with Apple Auth Provider

Closes: https://github.com/parse-community/parse-server/issues/5632

Should work out of the box.

* remove required options
2019-06-19 16:05:09 -05:00
greenkeeper[bot]
af82dd7bdd Update eslint-plugin-flowtype to the latest version 🚀 (#5656)
* chore(package): update eslint-plugin-flowtype to version 3.10.0

* chore(package): update lockfile package-lock.json
2019-06-12 05:41:21 +00:00
Faysal Ahmed
a58653ada8 Support LinkedIn v2 API (#5660) 2019-06-11 11:23:08 -05:00
Müller Zsolt
019cf0a986 added an RFC 7662 compliant OAuth2 auth adapter (#4910)
* added an RFC 7662 compliant OAuth2 auth adapter

* forgot to add the actual auth adapter to the previous commit

* fixed lint errors

* * added test coverage
* changed option names in auth adapter from snake case to camel case
* added underscore prefix to helper function names
* merged consecutive logger calls into one call and use JSON.stringify() to convert JSON objects to strings
* changed error handling (ParseErrors are no longer thrown, but returned)

* added description of the "debug" option and added this option to the tests too

* added a check of the "debug" option to the unittests and replaced require() of the logger with an import (the former does not work correctly)

* added AuthAdapter based auth adapter runtime validation to src/Adapters/Auth/index.js, added capability to define arbitrary providernames with an "adapter" property in auth config, replaced various "var" keywords with "const" in oauth2.js

* incorporated changes requested by flovilmart (mainly that oauth2 is now not a standalone adapter, but can be selected by setting the "oauth2" property to true in auth config

* modified oauth2 adapter as requested by flovilmart

* bugfix: defaultAdapter can be null in loadAuthAdapter() of index.js (my change broke the tests)

* added TODO on need for a validateAdapter() to validate auth adapters

* test cases and cleanup
2019-04-11 11:05:55 -05:00
Diamond Lewis
730f5c5c3d Allow test credentials for Facebook Auth (#5466)
* Allow test credentials for Facebook Auth

* node_env testing
2019-03-30 18:21:41 -05:00
Florent Vilmart
d83a0b6808 Use Prettier JS (#5017)
* Adds prettier

* Run lint before tests
2018-09-01 13:58:06 -04:00
orette
c7357ed109 Use the correct function when validating google auth tokens (#5018)
* Use the correct function when validating google auth tokens

httpsRequest.request expects the param postData and has no default value
or validation to check if it is missing before using it. As a result, an
error `TypeError: First argument must be a string or Buffer` is
thrown when an attempt is made to authenticate with Google.

A quick check on the LinkedIn, FB, and twitter authentication adapters
shows they are using httpsRequest.get for their validation calls.

* Correct google auth adapter tests
2018-08-30 20:17:46 -04:00
eddyLazar
41acaa0570 fixed vkontakte validateAuthData (#4977)
* fixed vkontakte validateAuthData

* updated changelog
2018-08-17 15:38:07 -04:00
Florent Vilmart
b9673da07b Refactor all auth adapters to reduce duplications (#4954)
* Refactor all auth adapters to reduce duplications

* Adds mocking and proper testing for all auth adapters

* Proper testing of the google auth adapter

* noit
2018-08-12 11:05:28 -04:00
oleg
b1017ac17c Send version for Vkontakte API (#4725) 2018-04-15 15:09:28 -04:00
SebC
6abf29dd97 Remove FB Graph API version from URL to use the oldest non deprecated version (2.5 for now, which will be deprecated soon) (#4650) 2018-03-15 14:05:41 -05:00
6thfdwp
213801c4b1 auth: add adapter for Facebook accountkit login (#4434)
* Integrate auth adapter for Facebook accountkit login

* Also verify Facebook app id associated with account kit login

* Add appsecret_proof as extra graph request parameter

* Specific error message for Account kit and more test coverage

* One more test to cover when AppIds for Facebook account kit not configured properly
2018-02-23 07:37:55 -05:00
RiverAge
a26e4c7470 fix: proper error message when login with wechat fails (#4000)
* fix typo

it should be weixin not qq.

* change error message from weixin to wechat

* remove unnecessary check
2017-07-08 08:29:02 -04:00