parse-community / parse-community/parse-server

feat: Support `useMasterKey` in `Parse.File.getData()`

Open
#10,428 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

New Feature

Description

Parse.File.getData() currently does not support useMasterKey or any authentication option. It always performs a plain HTTP fetch to the file URL without any auth headers.

This becomes a problem when the fileDownload server option is configured to restrict file downloads (e.g. enableForAuthenticatedUser: false). In that case, there is no SDK-level way to download a file with master key privileges — neither from Cloud Code nor from any server-side context.

Current Behavior
  • Parse.File.getData() performs a plain fetch(url) with no authentication
  • The fileDownload restriction blocks the request if file downloads are disabled
  • There is no option to pass useMasterKey: true or any other auth option
Proposed Solution

Add support for useMasterKey in getData():

const data = await file.getData({ useMasterKey: true });

When useMasterKey: true is passed in a server-side (Cloud Code) context, Parse Server should resolve the file through the files adapter directly (e.g. filesAdapter.getFileData(filename)) instead of making an HTTP request to the file URL. This approach:

  1. Bypasses the fileDownload HTTP restriction internally, similar to how useMasterKey works for queries and other operations
  2. Avoids sending master key credentials over HTTP, which would be problematic when file URLs point to external services (e.g. S3, CloudFront)
  3. Is consistent with the existing useMasterKey pattern used across the Parse SDK
Alternatives Considered
  • Sending master key headers in the HTTP request: Risky because file URLs may point to external services (S3, CloudFront), which would leak credentials to third-party domains.
  • Workaround with raw fetch and manual headers: Works but requires consumers to manage trusted origin checks and credential handling themselves, which is error-prone.
Environment
  • Parse Server: any version with fileDownload support
  • Parse JS SDK: current

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start at Parse.File.getData() and trace its current fetch path, then inspect the files adapter entry point getFileData(filename). Confirm how the useMasterKey option is handled in server-side Cloud Code and how fileDownload restrictions apply. Done means privileged downloads resolve through the adapter without sending master key credentials to external file URLs, while ordinary downloads keep working.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, nodejs
Domain
backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.