Easy way to disable master key requirements for all requests originating from the parse-server?

[yuzeh]

Hi,

We're migrating away from calling the Parse.Cloud.useMasterKey() call which won't work in parse-server, but it's a bit tedious because we have to tag a bunch of .save() and .find() and .get() function calls with the right config object. Furthermore, we'd need to keep tagging those function calls as we build out our app.

Ideally, we'd like any request that comes from the parse-server itself to automatically use the master key. (We are pretty sure there won't be any security issues in our app if this were to happen).

Is there a good way to do this? A brief look at the code seems to indicate I could make a wrapper around QueryController and friends to facilitate this.

Is this even a good idea? If so, I'd like to make a request for this feature.

[omairvaiyani]

There are times when a cloud function is called from a client-app where the requesting user may or may not have permission to perform the task. If master key is enabled throughout cloud code, ACLs could not be relied on in cloud functions.

That being said, I agree, it is tedious. I have added a saveAsMaster function to the Parse.Object.prototype to make things slightly more bearable.

[gfosco]

For most purposes, where a mobile app is interacting with a parse-server, this would be a bad idea. I understand the frustration if you're choosing to do all actions as master, but I think it is better to be explicit.

[yuzeh]

Thanks @omairvaiyani and @gfosco.

We have considered the saveAsMaster route. I know this works on Node, but will this work on hosted Parse? We want a solution that will work on both Parse and Node with zero code change (between Node and Parse versions).

[gfosco]

The best cross-platform approach would be passing the useMasterKey:true option to all the calls... but creating your own wrappers might work on both... Going to close this issue but feel free to keep discussing this here.