Parse-server: Broken Mail Verification: Invalid Verification Link

[funkenstrahlen]

Issue Description

I can not verify user mails. I always get invalid verification link.

My mail configuration:

  verifyUserEmails: true,
  emailVerifyTokenValidityDuration: 48 * 60 * 60, // in seconds (2 hours = 7200 seconds)
  preventLoginWithUnverifiedEmail: false, 

I checked for the verification token in the database:

It does set both values correctly after changing the mail address of a user.

This is the verification link it generates:

https://myserver.com/parse/apps/skgjhsfgkjhkjhsfdgkjh/verify_email?token=XmLufY59n3gMxDWQi5mOI6q5Z&username=funkenstrahlen

This does look very promising.

Steps to reproduce

• Change user mail address
• Click generated verification link

Expected Results

Mail is verified

Actual Outcome

Invalid verification link error

Environment Setup

• Server

  • parse-server version (Be specific! Don't say 'latest'.) : 2.7.4
  • Operating System: [FILL THIS OUT]
  • Hardware: Heroku Hobby
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): Heroku

• Database

  • MongoDB version: [FILL THIS OUT]
  • Storage engine: [FILL THIS OUT]
  • Hardware: [FILL THIS OUT]
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): mLab

[flovilmart]

Thanks for reporting the issue! Any chance you want to attempt to fix it?

[funkenstrahlen]

@flovilmart I already had a look at the code but could not find the source of the issue. Unfortunately I can not provide a PR with a fix in this case.

[flovilmart]

We’ll have a look then!

[funkenstrahlen]

I initially thought that this issue might be related: https://github.com/parse-community/parse-server/issues/4369

However as you can see in my bug report I confirmed the expiration times are correct.

[funkenstrahlen]

This is the relevant area in the code: https://github.com/parse-community/parse-server/blob/db8594dd33566af7bd51da93658f85bf735fdcb1/src/Controllers/UserController.js#L44-L70

Even after reading it many times I can not find the problem

[funkenstrahlen]

I discovered the problem! I do have some before save cloud code trigger on the user object. I expected request.original to always be set in my cloud code. However when the before save is triggered by the request to update the mail verification request.original is undefined.

In this case my before save trigger failed and therefore the database update request failed.