Skip to content

Commit e788d49

Browse files
steven-supersolidflovilmart
authored andcommitted
Don't require all keys to be configured to enable key checks (#2816) (#2941)
* Add tests. Fail request if any of the 4 optional keys does not match * Only require one key to be supplied in the request, except when no keys are configured * Use const over let, var
1 parent 278027a commit e788d49

File tree

2 files changed

+63
-14
lines changed

2 files changed

+63
-14
lines changed

spec/Middlewares.spec.js

Lines changed: 54 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -17,6 +17,7 @@ describe('middlewares', () => {
1717
return fakeReq.headers[key.toLowerCase()]
1818
}
1919
};
20+
fakeRes = jasmine.createSpyObj('fakeRes', ['end', 'status']);
2021
AppCache.put(fakeReq.body._ApplicationId, {});
2122
});
2223

@@ -35,6 +36,59 @@ describe('middlewares', () => {
3536
});
3637
});
3738

39+
it('should give invalid response when keys are configured but no key supplied', () => {
40+
AppCache.put(fakeReq.body._ApplicationId, {
41+
masterKey: 'masterKey',
42+
restAPIKey: 'restAPIKey'
43+
});
44+
middlewares.handleParseHeaders(fakeReq, fakeRes);
45+
expect(fakeRes.status).toHaveBeenCalledWith(403);
46+
});
47+
48+
it('should give invalid response when keys are configured but supplied key is incorrect', () => {
49+
AppCache.put(fakeReq.body._ApplicationId, {
50+
masterKey: 'masterKey',
51+
restAPIKey: 'restAPIKey'
52+
});
53+
fakeReq.headers['x-parse-rest-api-key'] = 'wrongKey';
54+
middlewares.handleParseHeaders(fakeReq, fakeRes);
55+
expect(fakeRes.status).toHaveBeenCalledWith(403);
56+
});
57+
58+
it('should give invalid response when keys are configured but different key is supplied', () => {
59+
AppCache.put(fakeReq.body._ApplicationId, {
60+
masterKey: 'masterKey',
61+
restAPIKey: 'restAPIKey'
62+
});
63+
fakeReq.headers['x-parse-client-key'] = 'clientKey';
64+
middlewares.handleParseHeaders(fakeReq, fakeRes);
65+
expect(fakeRes.status).toHaveBeenCalledWith(403);
66+
});
67+
68+
69+
it('should succeed when any one of the configured keys supplied', (done) => {
70+
AppCache.put(fakeReq.body._ApplicationId, {
71+
clientKey: 'clientKey',
72+
masterKey: 'masterKey',
73+
restAPIKey: 'restAPIKey'
74+
});
75+
fakeReq.headers['x-parse-rest-api-key'] = 'restAPIKey';
76+
middlewares.handleParseHeaders(fakeReq, fakeRes, () => {
77+
expect(fakeRes.status).not.toHaveBeenCalled();
78+
done();
79+
});
80+
});
81+
82+
it('should succeed when no keys are configured and none supplied', (done) => {
83+
AppCache.put(fakeReq.body._ApplicationId, {
84+
masterKey: 'masterKey'
85+
});
86+
middlewares.handleParseHeaders(fakeReq, fakeRes, () => {
87+
expect(fakeRes.status).not.toHaveBeenCalled();
88+
done();
89+
});
90+
});
91+
3892
const BodyParams = {
3993
clientVersion: '_ClientVersion',
4094
installationId: '_InstallationId',

src/middlewares.js

Lines changed: 9 additions & 14 deletions
Original file line numberDiff line numberDiff line change
@@ -120,20 +120,15 @@ export function handleParseHeaders(req, res, next) {
120120

121121
// Client keys are not required in parse-server, but if any have been configured in the server, validate them
122122
// to preserve original behavior.
123-
let keys = ["clientKey", "javascriptKey", "dotNetKey", "restAPIKey"];
124-
125-
// We do it with mismatching keys to support no-keys config
126-
var keyMismatch = keys.reduce(function(mismatch, key){
127-
128-
// check if set in the config and compare
129-
if (req.config[key] && info[key] !== req.config[key]) {
130-
mismatch++;
131-
}
132-
return mismatch;
133-
}, 0);
134-
135-
// All keys mismatch
136-
if (keyMismatch == keys.length) {
123+
const keys = ["clientKey", "javascriptKey", "dotNetKey", "restAPIKey"];
124+
const oneKeyConfigured = keys.some(function(key) {
125+
return req.config[key];
126+
});
127+
const oneKeyMatches = keys.some(function(key){
128+
return req.config[key] && info[key] == req.config[key];
129+
});
130+
131+
if (oneKeyConfigured && !oneKeyMatches) {
137132
return invalidRequest(req, res);
138133
}
139134

0 commit comments

Comments
 (0)