3

It's possible to "simulate" a user using the master key? I would like this feature to test what the user can really see in the application and verify that he does not have access to some part of it etc.

Is this possible without knowing the password of the user?

Simoyw
  • 681
  • 1
  • 9
  • 30

2 Answers2

2

If you want to test how user, roles, and permissions work, a simple way to do it is to make command line REST requests against the parse-server. Here's the guide.

You should be able to go into your parse dashboard and locate a user, look at their session token and then use that in queries to simulate that user's permissions.

With a session token, you can query objects in parse like this:

$ curl \
 -X GET \
 -H 'X-Parse-Application-Id: ABC123 \
 -H "X-Parse-Session-Token: r:XXXXXX" \
 -H "Content-Type: application/json" \
 https://cloud.so.good/parse/classes/Product

For a complex system, you'll want to cover your cloud code to ensure that all is working as expected. A good place to start would be with parse-server's extensive test coverage, including ACL's

Arthur Cinader
  • 1,547
  • 1
  • 12
  • 22
0

You can create a Parse.Session object for the particular user, setting the user and expiresAt fields. You creating the object, get the sessionToken key from the object. Then for any request you are trying to make, you will set the X-Parse-Session-Token header to be the value of the session token.

James Falade
  • 189
  • 2
  • 5
  • do you know a easy way to do "for any request you are trying to make, you will set the X-Parse-Session-Token header"? I maybe change the currect user on Parse JDK ? – Simoyw Oct 31 '19 at 10:32
  • If you are using the JavaScript SDK, you can modify the local storage manually and set the session token of the current user. – James Falade Nov 01 '19 at 09:11
  • I've created the Parse.Session object but I cannot retrieve the session token...it is only set on previous object – Simoyw Jan 30 '20 at 12:37
  • it works! We actually have to set the sessionToken string ourseleves...thanks – Simoyw Jan 31 '20 at 08:19
  • 1
    How were you able to set the user, sessionToken and other fields of a Session object? In parse website it says these are ReadObly Properties. And when I try to set those properties I get error. An example code will be of great help. – Teh Sunn Liu May 03 '20 at 10:21