Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add file bucket encryption using fileKey #6765

Merged
merged 4 commits into from
Jul 1, 2020

Conversation

cbaker6
Copy link
Contributor

@cbaker6 cbaker6 commented Jun 30, 2020

Adds fileKey encryption similar to original Parse. This is implemented for GridFSBucketAdapter and the FSFilesAdapter. This uses AES256-GCM so it can detect if files are tampered with.

To use, simply use the env var PARSE_SERVER_FILE_KEY, pass in --fileKey in the CL, or initialize ParseServer with fileKey="Your file encryptionKey". An example using GridFSBucketAdapter :

const api = new ParseServer({
  databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
  cloud: process.env.PARSE_SERVER_CLOUD || __dirname + '/cloud/main.js',
  appId: process.env.PARSE_SERVER_APPLICATION_ID || 'myAppId',
  masterKey: process.env.PARSE_SERVER_MASTER_KEY || '', 
  fileKey: process.env.PARSE_SERVER_FILE_KEY, //Add your file key here. Keep it secret
  ...
});

An example using FileSystemAdapter:

const api = new ParseServer({
  databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
  cloud: process.env.PARSE_SERVER_CLOUD || __dirname + '/cloud/main.js',
  appId: process.env.PARSE_SERVER_APPLICATION_ID || 'myAppId',
  masterKey: process.env.PARSE_SERVER_MASTER_KEY || '', 
  filesAdapter: new FSFilesAdapter({fileKey: process.env.PARSE_SERVER_FILE_KEY}), //Add your file key here. Keep it secret. Note that this is needed for Postgres or anyone using FSFilesAdapter. 
  ...
});

Be sure not to lose your key or change it after encrypting files. If you want to change your fileKey after encrypting, you will need the old fileKey and create CloudCode similar to what's mentioned below.

Note for those who already have unencrypted files using GridFSBucketAdapter or FSFilesAdapter adapters. You should look at #6768 for directions on how to encrypt your files.

This PR should not introduce any breaking changes

@codecov
Copy link

codecov bot commented Jun 30, 2020

Codecov Report

Merging #6765 into master will decrease coverage by 0.03%.
The diff coverage is 100.00%.

Impacted file tree graph

@@            Coverage Diff             @@
##           master    #6765      +/-   ##
==========================================
- Coverage   93.91%   93.88%   -0.04%     
==========================================
  Files         169      169              
  Lines       12029    12047      +18     
==========================================
+ Hits        11297    11310      +13     
- Misses        732      737       +5     
Impacted Files Coverage Δ
src/Adapters/Files/GridFSBucketAdapter.js 77.64% <100.00%> (+6.00%) ⬆️
src/Controllers/index.js 96.66% <100.00%> (ø)
src/Adapters/Storage/Mongo/MongoStorageAdapter.js 92.85% <0.00%> (-0.67%) ⬇️
src/RestWrite.js 93.67% <0.00%> (-0.33%) ⬇️

Continue to review full report at Codecov.

Legend - Click here to learn more
Δ = absolute <relative> (impact), ø = not affected, ? = missing data
Powered by Codecov. Last update d5ac0f7...38422d1. Read the comment docs.

Copy link
Member

@dplewis dplewis left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

LGTM!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants