parse-community / parse-community/parse-server
feat: Support `useMasterKey` in `Parse.File.getData()`
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Feature
Description
Parse.File.getData() currently does not support useMasterKey or any authentication option. It always performs a plain HTTP fetch to the file URL without any auth headers.
This becomes a problem when the fileDownload server option is configured to restrict file downloads (e.g. enableForAuthenticatedUser: false). In that case, there is no SDK-level way to download a file with master key privileges — neither from Cloud Code nor from any server-side context.
Current Behavior
Parse.File.getData()performs a plainfetch(url)with no authentication- The
fileDownloadrestriction blocks the request if file downloads are disabled - There is no option to pass
useMasterKey: trueor any other auth option
Proposed Solution
Add support for useMasterKey in getData():
const data = await file.getData({ useMasterKey: true });
When useMasterKey: true is passed in a server-side (Cloud Code) context, Parse Server should resolve the file through the files adapter directly (e.g. filesAdapter.getFileData(filename)) instead of making an HTTP request to the file URL. This approach:
- Bypasses the
fileDownloadHTTP restriction internally, similar to howuseMasterKeyworks for queries and other operations - Avoids sending master key credentials over HTTP, which would be problematic when file URLs point to external services (e.g. S3, CloudFront)
- Is consistent with the existing
useMasterKeypattern used across the Parse SDK
Alternatives Considered
- Sending master key headers in the HTTP request: Risky because file URLs may point to external services (S3, CloudFront), which would leak credentials to third-party domains.
- Workaround with raw
fetchand manual headers: Works but requires consumers to manage trusted origin checks and credential handling themselves, which is error-prone.
Environment
- Parse Server: any version with
fileDownloadsupport - Parse JS SDK: current
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start at Parse.File.getData() and trace its current fetch path, then inspect the files adapter entry point getFileData(filename). Confirm how the useMasterKey option is handled in server-side Cloud Code and how fileDownload restrictions apply. Done means privileged downloads resolve through the adapter without sending master key credentials to external file URLs, while ordinary downloads keep working.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, nodejs
- Domain
- backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Quiet
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100