Add file bucket encryption using fileKey #6765
Merged
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Adds fileKey encryption similar to original Parse. This is implemented for
GridFSBucketAdapter
and the FSFilesAdapter. This uses AES256-GCM so it can detect if files are tampered with.To use, simply use the env var
PARSE_SERVER_FILE_KEY
, pass in --fileKey in the CL, or initialize ParseServer withfileKey="Your file encryptionKey"
. An example usingGridFSBucketAdapter
:An example using
FileSystemAdapter
:Be sure not to lose your key or change it after encrypting files. If you want to change your fileKey after encrypting, you will need the old fileKey and create CloudCode similar to what's mentioned below.
Note for those who already have unencrypted files using
GridFSBucketAdapter
orFSFilesAdapter
adapters. You should look at #6768 for directions on how to encrypt your files.This PR should not introduce any breaking changes