parse-community / parse-community/parse-server
The `_hashed_password` field cannot be deleted from _User collection
Open
Nobody has claimed this yet.
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Description
New Issue Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Issue Description
The _hashed_password field cannot be deleted from _User collection
Steps to reproduce
I try
user.unset('_hashed_password')
Actual Outcome
The field is not deleted in the _User collection
Expected Outcome
_hashed_password field should be deleted in the _User collection
Environment
Server
- Parse Server version:
"parse-server": "^7.2.0", - Operating system:
Windows 10 - Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc):
Local
Database
- System (MongoDB or Postgres):
MongoDB - Database version:
v4.0.6 - Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc):
MongoDB Atlas
Client
- SDK (iOS, Android, JavaScript, PHP, Unity, etc):
JavaScript - SDK version:
5.3.0
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the issue with the JavaScript SDK call user.unset('_hashed_password') against Parse Server 7.2.0 and MongoDB. Trace how updates to the _User collection handle this field, then verify that the field is removed after the operation while preserving normal user behavior.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript, mongodb
- Domain
- authentication, backend, database
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100