Parse Cloud Code -- securely passing session token to Node.js server

Question

What is the secure way to access a user's session token from Parse Cloud Code functions with a self hosted Node.js server?

My cloud code function looks like this:

 PFCloud.callFunctionInBackground("checkUser", withParameters: nil) {
            (response: AnyObject?, error: NSError?) -> Void in
            let responseString = response as? String
            print(responseString)
 }

And I'd like to be able to do something like this:

Parse.Cloud.define("checkUser", function(request, response) {
    var sessionToken = request.user.getSessionToken();
    response.success(sessionToken);
});

However my request.user returns nil.

Is it safe to pass the session token as a parameter

let sessionToken = currentUser!.sessionToken

        PFCloud.callFunctionInBackground("checkUser", withParameters: ["sessionToken": sessionToken!]) {
            (response: AnyObject?, error: NSError?) -> Void in
            let responseString = response as? String
            print(responseString)
        }

Edit

I found something of use here: https://parse.com/tutorials/session-migration-tutorial

and it shows that I should be able to make it a header to the request:

curl -X POST \
  -H "X-Parse-Application-Id: <YOUR_APPLICATION_ID>" \
  -H "X-Parse-REST-API-Key: <YOUR_REST_API_KEY>" \
  -H "X-Parse-Session-Token: <CURRENT_LEGACY_SESSION_TOKEN>" \
  https://api.parse.com/1/upgradeToRevocableSession

but I'm not sure where these headers are set in the swift backend.

Peter Kaminski Peter Kaminski · Accepted Answer · 2016-06-25T20:36:35

Before asking this question, I didnt realize that at the end of the day, if you want to continue using Parse as your main server and do it securely, you'll need to add HTTPS to whichever hosting site you plan on using.

I went with AWS Elastic Beanstalk, and setting up HTTPS was no trivial task.

I've outlined a general method to add HTTPS to your parse server here: https://serverfault.com/questions/786247/steps-for-setting-up-https-using-elastic-beanstalk-with-a-load-balancer?noredirect=1#comment993545_786247

This is meant to be an accompaniment AWS's less than clear documentation they provide on the matter. http://docs.aws.amazon.com/elasticbeanstalk/latest/dg/configuring-https.html

HTTPS is the only secure way to pass parameters and a session token without risking it being sent over plain text.

Parse Cloud Code -- securely passing session token to Node.js server

1 Answers