parse-community / parse-community/parse-server
Allow the use of Cookies for authentication
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Feature / Enhancement Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Current Limitation
Due to using a SessionToken sent along with each request in the body of the request multiple problems arise:
There is no way to operate an application over multiple domains and subdomains without requiring a constant relogging of the user
It's impossible to differentiate between authenticated and unauthenticated requests in many CDNs edge functions and so some of the most efficient optimizations are nearly impossible to do
(eg. : For every request to Parse Server of unauthenticated users cache the response for 5 min)
Feature / Enhancement Description
Allow for an easy modification of the parse client js sdk and parse server (although that part can easily be done using express.js) to allow users to pass the sessionToken as part of a cookie that could eventually be cross site
Example Use Case
My Application is an online portfolio platform, users are allowed to set a custom domain to it in order to make it theirs, but they should be able to retain authentication in order to send messages and edit their portfolio
Alternatives / Workarounds
Editing the server part in order to transform a cookie into a sessiontoken in the body although impractical is possible in express.js, but I have found no way to override the Rest controller on the Parse SDK JS, the only other way possible would be to implement all parse sdk js from scratch and use a custom axios but this is way too complex
3rd Party References
Mostly every major platform uses cookies for auth
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue concerns the Parse JavaScript SDK request path and the Parse Server REST controller, with Express.js mentioned as a possible integration point. Start by tracing how sessionToken values are currently sent in requests; done means supporting authentication through cookies across custom domains and subdomains, with the required cross-site behavior defined and tested.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- express, javascript, node.js
- Domain
- api, authentication, backend
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100