Parse Server User Authentication

Question

I've transferred my parse.com app onto a Heroku App with MongoDB - https://github.com/ParsePlatform/parse-server-example (Heroku seems to be the most popular way of migrating away from the discontinuing service).

I can communicate with the REST API & write using the application key set in the Heroku setup. I now want to lock down API access, so that only logged-in users can call the API (set up as database stored users - not oAuth via Twitter, Facebook, etc).

This would have been done by the following in Parse.com (in app) App Settings > Users > Allow anonymous users

Are you saying that you don't want anonymous users to be able to make calls to the server as well as those logged in with Facebook or Twitter? — Dan Levy
I'm saying that I want to use the in DB users so that I don't have to rely on Facebook or Twitter OAuth. — Mr T
Ok so you want to just create a signup and login page with a username and password? — Dan Levy
I've already created the login page, I just want to be able to control db calls using username & password as per how it used to work. Even when I turn off the allow anonymous users, I can still query & alter the db with anonymous API calls. — Mr T
You used to allow a anymore users and now you don't want that feature? When a user logs in, PFUser.CurrentUser() is created. What I would try doing is only let the person into your app if PFUser.CurrentUser() != nil. Does this help or is your problem something else? — Dan Levy

Mr T Mr T · Accepted Answer · 2016-04-15T21:44:11

Having installed Parse Dashboard, this has informed me how security is set (in the MongoDB). In the _Schema table you can set it in the relevant column. IE below, only User can write to the table, whereas everyone can get & find data & no-one can add fields:

{
    "_id": "test",
    "ACL": "object",
    "title": "string",
    "productIdentifier": "string",
    "_metadata": {
        "class_permissions": {
            "get": {
                "*": true
            },
            "find": {
                "*": true
            },
            "create": {
                "User": true
            },
            "update": {
                "User": true
            },
            "delete": {
                "User": true
            },
            "addField": {}
        }
    }
}

Parse Server User Authentication

1 Answers