parse-community / parse-community/parse-server

Email Verification Link Generates "Invalid Verification Link" Error When username is in protectedFields

Open
#9,264 1 comment 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

type:bug
Dominant language
JavaScript
Stars
21.4k
Forks
4.8k
Avg merge
7h 45m
Merged PRs (30d)
11

Description

Issue Description

When the username field is included in the protectedFields configuration for the _User class, the email verification link generated results in an "Invalid Verification Link" error. This seems to be caused by the username parameter being set to undefined in the verification link.

Steps to reproduce

Add username to the protectedFields for the _User class in the Parse Server configuration.
Register a new user and trigger the email verification process.
Check the email verification link sent to the user's email. The username parameter in the link will be undefined.
Attempt to verify the email using the link, resulting in an "Invalid Verification Link" error.

Actual Outcome

The username parameter is set to undefined in the verification link, causing an "Invalid Verification Link" error when attempting to verify the email.

Expected Outcome

The username should be correctly included in the email verification link, and the link should allow successful email verification.

Environment

Server

Parse Server version: 7.2.0 (also tested with 7.0.0)
Operating system: macOS 14.6
Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Localhost

Database

System (MongoDB or Postgres): MongoDB
Database version: 7.0.12
Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Localhost

Client

SDK (iOS, Android, JavaScript, PHP, Unity, etc): iOS
SDK version: 1.19.4

Logs
verbose: REQUEST for [GET] /parse/apps/[APP_ID]/verify_email?token=[TOKEN]&username=undefined: {}
verbose: RESPONSE from [GET] /parse/apps/[APP_ID]/verify_email?token=[TOKEN]&username=undefined: {
  "status": 302,
  "location": "http://localhost:1337/parse/apps/invalid_verification_link.html?username=undefined&appId=[APP_ID]"

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by tracing the /verify_email endpoint and the protectedFields handling described in the issue. Reproduce with username included in _User protectedFields, then follow how the verification link receives its username parameter. Done means the generated link contains the username and successfully verifies the email instead of redirecting to invalid_verification_link.html.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript, node.js
Domain
api, authentication, backend
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.