{"error":"unauthorized"}

[DevDorrejo]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

when try to test the instance:

curl -X POST
-H "X-Parse-Application-Id: 7952e301430f8298150c2fee"
-H "Content-Type: application/json"
-d '{"score":1337,"playerName":"Sean Plott","cheatMode":false}'
http://localhost:1337/parse/classes/GameScore

Got: {"error":"unauthorized"}

Steps to reproduce

Run the next docker script

docker stop parse-server && docker rm parse-server

docker run -t
-d
--name parse-server
--network=host
parseplatform/parse-server
--appName Test-Sync
--appId 7952e301430f8298150c2fee
--masterKey 7c123bddb64af9b3afbf96c9
--clientKey c98d9050af40d700234dcf4f
--fileKey b41dedd9ebd5db1353a1b0e9
--javascriptKey c46ae6a339545e3f39e9bead
--restAPIKey 3f4bc0608db8f8d4a14cf0c9
--verbose=1
--databaseURI postgres://wedc:password@localhost/parse
--serverURL http://localhost:1337/parse
--publicServerURL http://wedc-parse.duckdns.org:1337/parse

Sent from the terminal:

curl -X POST
-H "X-Parse-Application-Id: 7952e301430f8298150c2fee"
-H "Content-Type: application/json"
-d '{"score":1337,"playerName":"Sean Plott","cheatMode":false}'
http://localhost:1337/parse/classes/GameScore

Actual Outcome

{"error":"unauthorized"}

Expected Outcome

{
"objectId": "2ntvSpRGIK",
"createdAt": "2016-03-11T23:51:48.050Z"
}

Environment

Docker:latest

Server

• Parse Server version: Docker
• Operating system: openSUSe Leap 15.2
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Local

Database

• System (MongoDB or Postgres): Postgres
• Database version: 12
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Local_Host

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): none
• SDK version: none

Logs

docker logs parse-server
allowClientClassCreation: true
appId: 7952e301430f8298150c2fee
appName: Test-Sync
cacheMaxSize: 10000
cacheTTL: 5000
clientKey: c98d9050af40d700234dcf4f
customPages: {}
databaseURI: postgres://wedc:password@localhost/parse
enableAnonymousUsers: true
expireInactiveSessions: true
fileKey: b41dedd9ebd5db1353a1b0e9
graphQLPath: /graphql
host: 0.0.0.0
idempotencyOptions: {"ttl":300,"paths":[]}
javascriptKey: c46ae6a339545e3f39e9bead
logsFolder: ./logs
masterKey: REDACTED
masterKeyIps: []
maxUploadSize: 20mb
mountPath: /parse
objectIdSize: 10
playgroundPath: /playground
port: 1337
protectedFields: {"_User":{"*":["email"]}}
publicServerURL: http://wedc-parse.duckdns.org:1337/parse
restAPIKey: 3f4bc0608db8f8d4a14cf0c9
revokeSessionOnPasswordReset: true
schemaCacheTTL: 5000
serverURL: http://localhost:1337/parse
sessionLength: 31536000
verbose: true
allowCustomObjectId: false
collectionPrefix:
directAccess: false
enableExpressErrorHandler: false
enableSingleSchemaCache: false
mountGraphQL: false
mountPlayground: false
preserveFileName: false
preventLoginWithUnverifiedEmail: false
scheduledPush: false
verifyUserEmails: false
jsonLogs: false
level: undefined

[1] parse-server running on http://localhost:1337/parse

[mtrezza]

Thanks for reporting.

• Could it be that you are missing the master key or session token in your CURL request?
• Also, do you have any ACL on the GameScore class?

curl -X POST
-H "X-Parse-Application-Id: 7952e301430f8298150c2fee"
-H "Content-Type: application/json"
-d '{"score":1337,"playerName":"Sean Plott","cheatMode":false}'
http://localhost:1337/parse/classes/GameScore

[DevDorrejo]

Thanks for reporting.

• Could it be that you are missing the master key or session token in your CURL request?
• Also, do you have any ACL on the GameScore class?

curl -X POST
-H "X-Parse-Application-Id: 7952e301430f8298150c2fee"
-H "Content-Type: application/json"
-d '{"score":1337,"playerName":"Sean Plott","cheatMode":false}'
http://localhost:1337/parse/classes/GameScore

ACL? is a clean install like the manual said, and what master key? and the curl have the parameter, i showed it,

@mtrezza ACL? I do not understand

[mtrezza]

Just to clarify where the questions are coming from, is @Ponchale1 an alias account of @DevDorrejo?

[DevDorrejo]

no, is a partner, we are working installing the service

[DevDorrejo]

parse have a container on hub.docker.com, looks like the official, so i did the docker run that i show up, do the test that is showed on the documentation and got the error.

[mtrezza]

It seems you are setting the client keys in the Parse Server configuration, but not in the request.

According to the docs:

Setting any of these keys will require all requests to provide one of the configured keys.

You can either remove the keys from your server configuration or add the restAPIKey to your request.

[DevDorrejo]

ok i will remove all and only will left the appid

[DevDorrejo]

{"objectId":"SlZGBPilzY","createdAt":"2020-08-02T23:54:39.562Z"}, looks like work, that sentence need to be on bold

[DevDorrejo]

so, if i use more Key, will have to add more headers for the key

[DevDorrejo]

now let us test the API on the android, before close

[mtrezza]

Glad to see that it worked.

so, if i use more Key, will have to add more headers for the key

Yes, as described in the docs, if a client key is set, it has to be provided in the request.

that sentence need to be on bold

In fact, in the manual the Docker example does not include setting any client IDs. However, if you think the documentation can be improved, please let us know where you would expect to see which information by opening an issue in the docs repo.

I'm closing this as it does not seem to be a Parse Server issue. For general help with Parse Server, here are some resources you can try:

• For code-level questions we recommend Stack Overflow using the parse-platform tag.
• For questions that are not appropriate for the above mentioned sites we recommend our community forum.

Feel free to comment if you have any questions and we can re-open this issue.