Skip to content

Remove detailed error from error messages #8958

Open
@mtrezza

Description

@mtrezza

New Feature / Enhancement Checklist

  • I am not disclosing a vulnerability.
    I am not just asking a question.
    I have searched through existing issues.

Current Limitation

For some requests, Parse Server returns more information than necessary in the error response. For example:

unauthorized: master key is required

This is providing an outside attacker with more info than necessary.

Feature / Enhancement Description

Especially when it comes to access / permission errors, I suggest to make the error messages more ambiguous by generalizing them and removing any specific information. Instead of explaining why a request was unauthorized, the error should be only unauthorized without any further details. The detailed error message should only be logged server side.

The task would be:

  • identify error messages that should be generalized
  • ensure a detailed error message is logged server side

This should not be a breaking change, as long as the error code does not change. Changes of error messages are not considered breaking as logic that relies on parsing error messages is considered bad practice anyway.

Activity

parse-github-assistant

parse-github-assistant commented on Feb 27, 2024

@parse-github-assistant

Thanks for opening this issue!

  • 🎉 We are excited about your ideas for improvement!
added
type:featureNew feature or improvement of existing feature
state:breakingBreaking change requires major version increment and `BREAKING CHANGE` commit message
bounty:$20Bounty applies for fixing this issue (Parse Bounty Program)
and removed
state:breakingBreaking change requires major version increment and `BREAKING CHANGE` commit message
on Feb 27, 2024
JiteshSinghShekhawat

JiteshSinghShekhawat commented on Aug 2, 2024

@JiteshSinghShekhawat

@mtrezza is the issue still open ?

mtrezza

mtrezza commented on Aug 2, 2024

@mtrezza
MemberAuthor

Yes

JiteshSinghShekhawat

JiteshSinghShekhawat commented on Aug 3, 2024

@JiteshSinghShekhawat

can you assign this issue to me ? @mtrezza

mtrezza

mtrezza commented on Aug 3, 2024

@mtrezza
MemberAuthor

Please feel free to pick this up and post a comment for others to be aware that it's in the works.

JiteshSinghShekhawat

JiteshSinghShekhawat commented on Aug 4, 2024

@JiteshSinghShekhawat

I'm picking up this issue and will be working on it.

JiteshSinghShekhawat

JiteshSinghShekhawat commented on Aug 4, 2024

@JiteshSinghShekhawat

@mtrezza basically i have to do this in /src/Adapters/Auth or there any other folder also ?

mtrezza

mtrezza commented on Aug 5, 2024

@mtrezza
MemberAuthor

This relates to any response message across Parse Server where more information than necessary is returned. I suggest to do this with just 1 or a few messages, then open a PR for feedback, so you don't make a lot of changes and then have to modify them again.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Metadata

Metadata

Assignees

No one assigned

    Labels

    bounty:$20Bounty applies for fixing this issue (Parse Bounty Program)type:featureNew feature or improvement of existing feature

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

      Participants

      @mtrezza@JiteshSinghShekhawat

      Issue actions

        Remove detailed error from error messages · Issue #8958 · parse-community/parse-server