{"action":"created","issue":{"url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3455","repository_url":"https://api.github.com/repos/ParsePlatform/parse-server","labels_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3455/labels{/name}","comments_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3455/comments","events_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3455/events","html_url":"https://github.com/ParsePlatform/parse-server/issues/3455","id":204121959,"number":3455,"title":"iOS SDK sends `x-parse-client-key` for push notifications but server expects ` `X-Parse-Master-Key`","user":{"login":"jaimeagudo","id":4053914,"avatar_url":"https://avatars.githubusercontent.com/u/4053914?v=3","gravatar_id":"","url":"https://api.github.com/users/jaimeagudo","html_url":"https://github.com/jaimeagudo","followers_url":"https://api.github.com/users/jaimeagudo/followers","following_url":"https://api.github.com/users/jaimeagudo/following{/other_user}","gists_url":"https://api.github.com/users/jaimeagudo/gists{/gist_id}","starred_url":"https://api.github.com/users/jaimeagudo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jaimeagudo/subscriptions","organizations_url":"https://api.github.com/users/jaimeagudo/orgs","repos_url":"https://api.github.com/users/jaimeagudo/repos","events_url":"https://api.github.com/users/jaimeagudo/events{/privacy}","received_events_url":"https://api.github.com/users/jaimeagudo/received_events","type":"User","site_admin":false},"labels":[],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2017-01-30T20:34:17Z","updated_at":"2017-01-30T23:18:15Z","closed_at":"2017-01-30T20:53:32Z","body":"### Issue Description\r\n\r\nDescribe your issue in as much detail as possible.\r\n\r\nUsing iOS SDK the headers when sending Push Notifications for the master-key are simply inconsistent following the tutorial. The SDK sends the key in `x-parse-client-key` but the REST is waiting for `X-Parse-Master-Key`. Hence my curl tests are fine but my iOS SDK is failing.\r\n\r\nSee https://github.com/ParsePlatform/parse-server/blob/f864141663533bc6195dcbd4622e735798bfac81/src/middlewares.js#L24\r\n\r\n[FILL THIS OUT]\r\n\r\n### Steps to reproduce\r\n\r\nPlease include a detailed list of steps that reproduce the issue. Include curl commands when applicable.\r\n\r\n1. Open a sample iOS SDK Project \r\n```swift\r\nlet push = PFPush()\r\n        pushQuery.whereKey(\"user\", equalTo:  PFUser.current()!)\r\n        push.setQuery(pushQuery) \r\n        push.setMessage(\"hello world\")\r\n        push.sendInBackground()\r\n```\r\n\r\n#### Expected Results\r\n\r\nThe logs on server are ok, returns 200\r\n\r\n#### Actual Outcome\r\n```json\r\n\"error\": {\r\n        \"status\": 403,\r\n        \"message\": \"unauthorized: master key is required\"\r\n    },\r\n```\r\n### Environment Setup\r\n\r\n- **Server**\r\n  - parse-server version (Be specific! Don't say 'latest'.) : 2.3.2\r\n  - Operating System:     Ubuntu 16.04\r\n  - Hardware:             LINODE \r\n  - Localhost or remote server? Linode \r\n\r\n- **Database**\r\n  IRRELEVANT\r\n\r\n### Logs/Trace\r\n\r\n```json\r\n{\r\n    \"method\": \"POST\",\r\n    \"url\": \"/parse/push\",\r\n    \"headers\": {\r\n        \"x-forwarded-for\": \"88.17.YY.XXX\",\r\n        \"host\":\"myserver:41337\",\r\n        \"x-nginx-proxy\": \"true\",\r\n        \"connection\": \"upgrade\",\r\n        \"content-length\": \"165\",\r\n        \"x-parse-client-version\": \"i1.14.2\",\r\n        \"accept\": \"*/*\",\r\n        \"x-parse-session-token\": \"r:7df48309d473e1e9e403aa0c2e35dcfb\",\r\n        \"x-parse-application-id\": \"MYAPP\",                               \r\n        \"x-parse-client-key\": \"myprivatekey_justfine\",\r\n        \"x-parse-installation-id\": \"12afc24d-37c0-484f-9e73-1bf6756c3d4c\",\r\n        \"x-parse-os-version\": \"10.2 (16B2555)\",\r\n        \"accept-language\": \"en-us\",\r\n        \"accept-encoding\": \"gzip, deflate\",\r\n        \"content-type\": \"application/json; charset=utf-8\",\r\n        \"user-agent\": \"app/1 CFNetwork/808.2.16 Darwin/16.1.0\",\r\n        \"x-parse-app-build-version\": \"1\",\r\n        \"x-parse-app-display-version\": \"0.1\"\r\n    },\r\n    \"body\": {\r\n        \"where\": {\r\n            \"user\": {\r\n                \"__type\": \"Pointer\",\r\n                \"className\": \"_User\",\r\n                \"objectId\": \"p1w7xaoRAL\"\r\n            }\r\n        },\r\n        \"data\": {\r\n            \"alert\": \"Carol J would love to work at Sonora Disco! Call him/her now!\"\r\n        }\r\n    },\r\n    \"level\": \"verbose\",\r\n    \"message\": \"REQUEST for [POST] /parse/push: {\\n  \\\"where\\\": {\\n    \\\"user\\\": {\\n      \\\"__type\\\": \\\"Pointer\\\",\\n      \\\"className\\\": \\\"_User\\\",\\n      \\\"objectId\\\": \\\"p1w7xaoRAL\\\"\\n    }\\n  },\\n  \\\"data\\\": {\\n    \\\"alert\\\": \\\"Hi Carol !\\\"\\n  }\\n}\"\r\n}\r\n1 | Paid2Par | {\r\n    \"error\": {\r\n        \"status\": 403,\r\n        \"message\": \"unauthorized: master key is required\"\r\n    },\r\n    \"level\": \"error\",\r\n    \"message\": \"Error generating response. { Error: unauthorized: master key is required\\n    at promiseEnforceMasterKeyAccess (/home/jaime/production/source/node_modules/parse-server/lib/middlewares.js:297:17)\\n    at /home/jaime/production/source/node_modules/parse-server/lib/PromiseRouter.js:132:22\\n    at process._tickDomainCallback (internal/process/next_tick.js:129:7) status: 403, message: 'unauthorized: master key is required' }\"\r\n}\r\n1 | myapp | Error: unauthorized: master key is required\r\n1 | myapp | at promiseEnforceMasterKeyAccess(/home/jaime / production / source / node_modules / parse - server / lib / middlewares.js: 297: 17)\r\n1 | myapp | at / home / jaime / production / source / node_modules / parse - server / lib / PromiseRouter.js: 132: 22\r\n1 | myapp | at process._tickDomainCallback(internal / process / next_tick.js: 129: 7)\r\n```\r\nYou can turn on additional logging by configuring VERBOSE=1 in your environment.\r\n\r\nPossibly related to https://github.com/ParsePlatform/parse-server/issues/3022\r\n\r\nJust in case you doubt about the installation requests with\r\n```\r\n \"method\": \"POST\",\r\n    \"url\": \"/parse/classes/\r\n\r\n    \"x-parse-client-key\":\r\n```\r\nWorks just fine"},"comment":{"url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/comments/276223470","html_url":"https://github.com/ParsePlatform/parse-server/issues/3455#issuecomment-276223470","issue_url":"https://api.github.com/repos/ParsePlatform/parse-server/issues/3455","id":276223470,"user":{"login":"flovilmart","id":364568,"avatar_url":"https://avatars.githubusercontent.com/u/364568?v=3","gravatar_id":"","url":"https://api.github.com/users/flovilmart","html_url":"https://github.com/flovilmart","followers_url":"https://api.github.com/users/flovilmart/followers","following_url":"https://api.github.com/users/flovilmart/following{/other_user}","gists_url":"https://api.github.com/users/flovilmart/gists{/gist_id}","starred_url":"https://api.github.com/users/flovilmart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flovilmart/subscriptions","organizations_url":"https://api.github.com/users/flovilmart/orgs","repos_url":"https://api.github.com/users/flovilmart/repos","events_url":"https://api.github.com/users/flovilmart/events{/privacy}","received_events_url":"https://api.github.com/users/flovilmart/received_events","type":"User","site_admin":false},"created_at":"2017-01-30T23:18:15Z","updated_at":"2017-01-30T23:18:15Z","body":"So, I'll weigh in,\r\n\r\nWe disabled the ability to send push notifications from clients for security reasons, as it was originally encouraged on parse.com.\r\n\r\nRegarding the masterKey interception, if your master key leaks, you should rotate it, your master key should be treated as sensitive as your database passwords, private keys etc... \r\n\r\n@NatanRolnik provided a proper explanation for the expected behavior. \r\n\r\nIf you really wish to allow push on client, you can either use your own fork, or open a PR that introduces option like `allowClientPush` (Which would be off by default).\r\n\r\n"}}
{"actor":{"display_login":"flovilmart"}}