Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Remove detailed error from error messages #8958

Open
3 tasks done
mtrezza opened this issue Feb 27, 2024 · 8 comments · May be fixed by #9267
Open
3 tasks done

Remove detailed error from error messages #8958

mtrezza opened this issue Feb 27, 2024 · 8 comments · May be fixed by #9267
Labels
bounty:$20 Bounty applies for fixing this issue (Parse Bounty Program) type:feature New feature or improvement of existing feature

Comments

@mtrezza
Copy link
Member

mtrezza commented Feb 27, 2024

New Feature / Enhancement Checklist

Current Limitation

For some requests, Parse Server returns more information than necessary in the error response. For example:

unauthorized: master key is required

This is providing an outside attacker with more info than necessary.

Feature / Enhancement Description

Especially when it comes to access / permission errors, I suggest to make the error messages more ambiguous by generalizing them and removing any specific information. Instead of explaining why a request was unauthorized, the error should be only unauthorized without any further details. The detailed error message should only be logged server side.

The task would be:

  • identify error messages that should be generalized
  • ensure a detailed error message is logged server side

This should not be a breaking change, as long as the error code does not change. Changes of error messages are not considered breaking as logic that relies on parsing error messages is considered bad practice anyway.

Copy link

parse-github-assistant bot commented Feb 27, 2024

Thanks for opening this issue!

  • 🎉 We are excited about your ideas for improvement!

@mtrezza mtrezza added type:feature New feature or improvement of existing feature state:breaking Breaking change requires major version increment and `BREAKING CHANGE` commit message bounty:$20 Bounty applies for fixing this issue (Parse Bounty Program) and removed state:breaking Breaking change requires major version increment and `BREAKING CHANGE` commit message labels Feb 27, 2024
@JiteshSinghShekhawat
Copy link

@mtrezza is the issue still open ?

@mtrezza
Copy link
Member Author

mtrezza commented Aug 2, 2024

Yes

@JiteshSinghShekhawat
Copy link

can you assign this issue to me ? @mtrezza

@mtrezza
Copy link
Member Author

mtrezza commented Aug 3, 2024

Please feel free to pick this up and post a comment for others to be aware that it's in the works.

@JiteshSinghShekhawat
Copy link

I'm picking up this issue and will be working on it.

@JiteshSinghShekhawat
Copy link

@mtrezza basically i have to do this in /src/Adapters/Auth or there any other folder also ?

@mtrezza
Copy link
Member Author

mtrezza commented Aug 5, 2024

This relates to any response message across Parse Server where more information than necessary is returned. I suggest to do this with just 1 or a few messages, then open a PR for feedback, so you don't make a lot of changes and then have to modify them again.

@JiteshSinghShekhawat JiteshSinghShekhawat linked a pull request Aug 5, 2024 that will close this issue
4 tasks
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bounty:$20 Bounty applies for fixing this issue (Parse Bounty Program) type:feature New feature or improvement of existing feature
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants