parse-community / parse-community/parse-server
Managing Session Issues - Parse error: Invalid session token
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
Hosting: locally on OSX running parse server 3.5.0
I am having massive issues with sessions on my cloud infrastructure, when a device tries to make a request with a session that does not exist it cripples the entire server. with the following error
[1] error: Parse error: Invalid session token {"code":209,"stack":"Error: Invalid session token\n at Object.getAuthForSessionToken (.../node_modules/parse-server/lib/Auth.js:114:11)\n at process._tickCallback (internal/process/next_tick.js:68:7)"}
Is there anyway to validate that a session exists before killing the server with an error, been trying to use express middleware but I cant seem to find an entry point to add any code for doing checks, also I have read the docs and found this https://docs.parseplatform.org/js/guide/#handling-invalid-session-token-error
however I also cannot seem to locate the entry point in the rest api that causes this error, I have removed all code from my main.ts file so there is only 1 rest item being hit but I still see the invalid session error showing up...
Whats weird is that I can do a CURL request with no session headers etc and it goes through fine, could something on the client side be causing this error and pushing it to the server, or is there an entry point that processes the request before sending to the cloud function handler, this is what I need to find and modify with a session checker.
On the client side I am using a service which calls the cloud functions, perhaps the session is somehow contained in this Parse.Cloud.run and it fails here within the app rather than over on the remote server ? could this be the case
async cloud(cloudFunctionName: string, params?: any): Promise<any> {
try {
const result = await Parse.Cloud.run(cloudFunctionName, params)
return result
} catch (error) {
throw error
}
}
any ideas ?
async function loggedUser(sessionToken: string) {
const loggedUserSessionQuery = new Parse.Query(Parse.Session);
loggedUserSessionQuery.equalTo('sessionToken', sessionToken);
loggedUserSessionQuery.include('user');
const loggedUserSession = await loggedUserSessionQuery.first({
sessionToken
});
if (!loggedUserSession) {
throw new Error('Invalid session token.');
}
return loggedUserSession.get('user');
}
or this
const myMiddleware = function (req, res, next) {
const json = res.json;
res.json = function (object) {
if (object.code == Parse.Error.INVALID_SESSION_TOKEN) {
// get the session token
const token = req.headers['x-parse-session-token'];
// Invalid token, do something
}
// Forward the response
json.call(res, object);
}
next()
}
related issues:
https://github.com/parse-community/parse-server/issues/5209
https://github.com/parse-community/parse-server/issues/618
https://github.com/parse-community/parse-server/issues/4395
https://stackoverflow.com/questions/50477035/parse-server-capture-bad-session-token-requests/50488603
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with parse-server/lib/Auth.js at the reported getAuthForSessionToken location, then trace how Parse.Cloud.run requests enter the REST and cloud-function handlers. Review the related issues and compare requests with and without session headers. Done means identifying whether the invalid token is client- or server-originated and documenting or fixing the request path so it no longer cripples the server.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- express, javascript, node.js
- Domain
- api, authentication, backend
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100