Pass anonymous PFUser to Cloud Code in Parse iOS SDK

Question

I'm trying to secure a Cloud function in my Parse app. This function doesn't create objects or anything. It just calls an external API and returns the result. However, to make it secure I'm trying to create an anonymous user using the iOS SDK like so:

PFUser.enableAutomaticUser()
print(PFUser.currentUser())

which outputs

Optional(<PFUser: 0x7fd3535570c0, objectId: new, localId: (null)> {})

So seems like the user is being created. But when I make a request using the PFCloud object, my parse function in Cloud gets a null user:

PFCloud.callFunctionInBackground("<endpoint>", withParameters:[<params_dict>], block: {(result) -> Void in
    print(result)
})

Result on console log says "user":null. Does anyone know what I could be missing? Also, is this the best way to ensure requests are coming from my iOS client only, and not from some other source?

Thanks.

Answer 1

Your anonymous user is null because unless you save that user or an object related to it, it will not exist on the server. From Parse documentation:

Anonymous users can also be automatically created for you without requiring a network request, so that you can begin working with your user immediately when your application starts. When you enable automatic anonymous user creation at application startup, [PFUser currentUser] will never be nil. The user will automatically be created in the cloud the first time the user or any object with a relation to the user is saved. Until that point, the user's object ID will be nil.

Also you cannot simply check if a request is coming from an iOS client. The whole point of a REST system is that server does not keep any state, it just responds to the requests from different sources. The sources have to send in their credentials (usually in a from of a security token which is issued by the server during a login) with every request. Server verifies the token is genuine and has not been tampered with before serving the request. Parse provides you with user authentication which makes it easy for you to verify that a logged in user is requesting something. You can then build extra security measures on top of that to make sure only certain users are allowed to access certain data.