parse-community / parse-community/parse-server

Managing Session Issues - Parse error: Invalid session token

Open
#6,082 5 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

Hosting: locally on OSX running parse server 3.5.0

I am having massive issues with sessions on my cloud infrastructure, when a device tries to make a request with a session that does not exist it cripples the entire server. with the following error

[1] error: Parse error: Invalid session token {"code":209,"stack":"Error: Invalid session token\n    at Object.getAuthForSessionToken (.../node_modules/parse-server/lib/Auth.js:114:11)\n    at process._tickCallback (internal/process/next_tick.js:68:7)"}

Is there anyway to validate that a session exists before killing the server with an error, been trying to use express middleware but I cant seem to find an entry point to add any code for doing checks, also I have read the docs and found this https://docs.parseplatform.org/js/guide/#handling-invalid-session-token-error

however I also cannot seem to locate the entry point in the rest api that causes this error, I have removed all code from my main.ts file so there is only 1 rest item being hit but I still see the invalid session error showing up...

Whats weird is that I can do a CURL request with no session headers etc and it goes through fine, could something on the client side be causing this error and pushing it to the server, or is there an entry point that processes the request before sending to the cloud function handler, this is what I need to find and modify with a session checker.

On the client side I am using a service which calls the cloud functions, perhaps the session is somehow contained in this Parse.Cloud.run and it fails here within the app rather than over on the remote server ? could this be the case

    async cloud(cloudFunctionName: string, params?: any): Promise<any> {
        try {
            const result = await Parse.Cloud.run(cloudFunctionName, params)
            return result
        } catch (error) {
            throw error
        }
    }

any ideas ?

async function loggedUser(sessionToken: string) {
  const loggedUserSessionQuery = new Parse.Query(Parse.Session);
  loggedUserSessionQuery.equalTo('sessionToken', sessionToken);
  loggedUserSessionQuery.include('user');

  const loggedUserSession = await loggedUserSessionQuery.first({
    sessionToken
  });

  if (!loggedUserSession) {
    throw new Error('Invalid session token.');
  }

  return loggedUserSession.get('user');
}

or this

const myMiddleware = function (req, res, next) {
    const json = res.json;
    res.json = function (object) {
        if (object.code == Parse.Error.INVALID_SESSION_TOKEN) {
            // get the session token
            const token = req.headers['x-parse-session-token'];
            // Invalid token, do something
        }
        // Forward the response
        json.call(res, object);
    }
    next()
}

related issues:
https://github.com/parse-community/parse-server/issues/5209
https://github.com/parse-community/parse-server/issues/618
https://github.com/parse-community/parse-server/issues/4395
https://stackoverflow.com/questions/50477035/parse-server-capture-bad-session-token-requests/50488603

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with parse-server/lib/Auth.js at the reported getAuthForSessionToken location, then trace how Parse.Cloud.run requests enter the REST and cloud-function handlers. Review the related issues and compare requests with and without session headers. Done means identifying whether the invalid token is client- or server-originated and documenting or fixing the request path so it no longer cripples the server.

Written by the indexing model from the issue text.

Assessment

Tech stack
express, javascript, node.js
Domain
api, authentication, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.