Parse-sdk-js: Change default login method to POST

[jjunineuro]

Hello everyone,

I really liked the application, however, I saw that the method for logging in with email and password uses the GET method.

I know that being in secure SSL connection this data is encrypted, however, according to the current Data Protection Laws, the login data is in the request log on the server, this is not at all interesting.

Imagine Parse's paid consumer services, the network administrator will have access to all users and user passwords. This is not cool.

Therefore, I hereby suggest changing the Login class with email and password to use the POST method.

The following image link of what I am explaining.

https://ibb.co/Y0Q1j3P

[mtrezza]

Thanks for opening this issue.

The Parse Server login endpoint accepts both GET and POST methods.

I assume your observation comes from the Parse Javascript SDK. The ParseUser.login() method uses the GET method to log in by default, but also accepts an option usePost: true which makes it use the POST method to log in:

https://github.com/parse-community/Parse-SDK-JS/blob/d40f1505a29ae0080d6094f5557f4f372f14a428/src/ParseUser.js#L1082

However, I support the notion that the POST method should be used by default to facilitate security best practice.
Would you be willing to open a PR to change the default to POST?

It is just a tiny change here to set the default value:
https://github.com/parse-community/Parse-SDK-JS/blob/d40f1505a29ae0080d6094f5557f4f372f14a428/src/ParseUser.js#L446-L448

_Note: This issue has been moved since this is an issue specific to the Parse Javascript SDK._

[jjunineuro]

Hello, thank you very much for your help.

I made the change in the Parse Javascript SDK and it worked.

But when testing on the Parse Flutter SDK, I don't have this option and I can't login using the POST method.

Could you help me with the Parse Flutter SDK too?

In the Parse Flutter SDK

In the Parse Javascript SDK

[dplewis]

@mtrezza @davimacedo The login only supported GET initially which is why the SDK have a GET and not POST since POST was added later on.

It was added 3 years ago to the server, released on version 2.6.4.

PR -> https://github.com/parse-community/parse-server/pull/4268

Since it was so long ago, we can make POST the default.

What do you guys think?

[mtrezza]

Yes, POST should be default, we should mark it as breaking change though in case someone has a restrictive firewall based on the endpoint / http method combination.

I think we should still allow GET for the login endpoint however, in the spirit of Parse Server's versatility.

@jjunineuro Would you please open a separate issue in the Flutter SDK repo and reference this issue?

[jjunineuro]

Yes @mtrezza, it already opens the problem in the Flutter SDK.

Thank you!!!

https://github.com/parse-community/Parse-SDK-Flutter/issues/542

[mtrezza]

Thanks @jjunineuro, for pointing this issue out. Would you also want to open a PR in any of the SDKs to fix this?

[jjunineuro]

Yes @mtrezza , I appreciate the opportunity to contribute. But I have advanced knowledge, I tried to understand the code, but I didn't see the calls through the Login in the Flutter SDK. But I will dedicate a few hours to understand and implement this improvement.

[mtrezza]

Great! If you need any guidance please feel free to ask.