Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Wrongly generate _Session when login by Facebook #852

Closed
tobernguyen opened this issue Mar 5, 2016 · 1 comment
Closed

Wrongly generate _Session when login by Facebook #852

tobernguyen opened this issue Mar 5, 2016 · 1 comment

Comments

@tobernguyen
Copy link
Contributor

Here is how to reproduce:

  • My database is clean.
  • My browser is clean (by localStorage.clear())
  • I logged in with my Facebook account
  • => Parse Server create new user with objectId: PRGzlgxcoE
  • => Parse Server create _Session with user column point to PRGzlgxcoE, which is correct
  • I logged out (by Parse.User.logOut())
  • I logged in again with same Facebook account
  • => This time, Parse Server modified the last created session, as I know, what it did is refreshing the token, BUT IT ALSO CHANGE THE user column to an unknown object: L1wysagBDK (which should be PRGzlgxcoE).
  • And of course after that, I became an invalid user because my sessionToken is not pointed to me. Which made any cloud function I call is not from authenticated user (request.user is null).

Bonus step:

  • Now I don't log out by Parse.User.logOut(), I use: localStorage.clear(), which will also clear the Installation of Parse and the current logged in user.
  • I logged in again with same Facebook account
  • => Parse Server create new _Session with user column point to another unknown object: C40NzjGJen

Every time I try to sign out or clear local storage, Parse Server will create(modify) a session with invalid user column.
But if I change to api.parse.com endpoint, this does not happen at all, all session is generated with correct user column.

Note that, the api.parse.com and my Parse Server point to the same mongo database, with same AppID and MasterKey.

I've tested this on Parse Server 2.1.6 and 2.1.2.

@gfosco
Copy link
Contributor

gfosco commented Mar 6, 2016

Fixed by 857, will be in next release. 👍

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants