Session token missing while creating new user.

[yog27ray]

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

On creating a new user session token is missing. Below are the steps to reproduce.

package.json

{
  "name": "parse-server-error",
  "version": "1.0.0",
  "description": "",
  "main": "index.js",
  "scripts": {
    "test": "echo \"Error: no test specified\" && exit 1"
  },
  "author": "",
  "license": "ISC",
  "dependencies": {
    "express": "^4.18.2",
    "http": "^0.0.1-security",
    "parse-server": "6.1.0-alpha.7"
  }
}

app.js

const express = require('express');
const http = require('http');
const { ParseServer } = require('parse-server');

const app = express();
const server = http.createServer(app);

const parseServerOption = {
  databaseURI: 'mongodb://mongo:27017/test',
  appId: 'myAppId',
  masterKey: 'myMasterKey',
  serverURL: 'http://localhost:9000/api/parse',
}


async function start() {
  const parseServer = new ParseServer(parseServerOption);
  await parseServer.start();
  app.use('/api/parse', parseServer.app);
  server.listen(9000, '0.0.0.0', async () => {
    console.log('>>>>server running');
    const user = new Parse.User();
    await user.save({ username: 'test', password: 'test' }, { useMasterKey: true });
    console.log('>>>>userId:', user.id, '\tsessionToken:', user.getSessionToken());
  });
}

start();

Start Server

node -v
v16.16.0
npm -v
8.11.0
node app.js

Output

warn: DeprecationWarning: The Parse Server option 'allowClientClassCreation' default will change to 'false' in a future version.
warn: DeprecationWarning: The Parse Server option 'allowExpiredAuthDataToken' default will change to 'false' in a future version.
>>>>server running
>>>>userId: yzNE1MbWh6  sessionToken: undefined

[parse-github-assistant]

Thanks for opening this issue!

[mtrezza]

Could you open a PR failing test? You don't have to post the whole setup as you did here, if a simple 3 line test can demo the issue.

[yog27ray]

@mtrezza I tried writing a failing test case, but in the test case, the session token is present. But why used in the project, the session token is not present. That is the reason I have shared the setup files.

[mtrezza]

Got it, thanks for clarifying. Is a session created in the _Session table?

[yog27ray]

Only 4 tables exists in database.

1. _Idempotency: No rows
2. _Role: No rows
3. _SCHEMA: 2 rows, one for user and another for role
4. _User: 1 row

_Session table is missing.

If I call login function after user creation then _Session table is created with one row in it.
await Parse.User.logIn('test', 'test');

[dblythy]

I'm assuming this is expected as session tokens are only created on signup or login calls - not save calls. If you change your code to await user.signUp({ username: 'test', password: 'test' }, { useMasterKey: true }); does the session come through?

[yog27ray]

@dblythy I tried replacing save call with await user.signUp({ username: 'test', password: 'test' }, { useMasterKey: true }); but still user.getSessionToken() is returning undefined.

I also tried await Parse.User.signUp('test', 'test', {}, { useMasterKey: true }); but same result.

In both the cases _Session table is missing.

[mtrezza]

The whole _Session table is missing?

Not sure if that table is created as needed or only once if needed on initial server launch. Can you set the debug level of Parse Server to "silly" and post the logs when you try to sign up a user? Also set VERBOSE=1 in the env vars. There should be more logged than what you posted above.

[yog27ray]

Yes the whole _Session table is missing.

I made the bellow changes

1. Add verbose and logLevel in parse option.

const parseServerOption = {
  databaseURI: 'mongodb://mongo:27017/test',
  appId: 'myAppId',
  masterKey: 'myMasterKey',
  serverURL: 'http://localhost:9000/api/parse',
  verbose: true,
  logLevel: 'silly',
}

2. server start command.

VERBOSE=1 node app.js

But in terms of log, there is no change. In logs folder two files got created.

1. Empty parse-server.err.2023-03-13
2. parse-server.info.2023-03-13

{"level":"warn","message":"DeprecationWarning: The Parse Server option 'allowClientClassCreation' default will change to 'false' in a future version.","timestamp":"2023-03-13T02:12:18.971Z"}
{"level":"warn","message":"DeprecationWarning: The Parse Server option 'allowExpiredAuthDataToken' default will change to 'false' in a future version.","timestamp":"2023-03-13T02:12:18.972Z"}

[dblythy]

Can you try with directAccess to false? Alternatively try user.signUp({ installationId: 'random' })

From my investigation, if installationId is set to cloud, a session token won't be created:

https://github.com/parse-community/parse-server/blob/alpha/src/RestWrite.js#L887-L892

This can also occur with directAccess and if no installationId is specified:

https://github.com/parse-community/parse-server/blob/alpha/src/ParseServerRESTController.js#L13-L17

[yog27ray]

@dblythy I verified it either directAccess to false or passing installationId in the option, is returning session token. Do we consider this a bug?

[yog27ray]

@dblythy @mtrezza are we going to fix this issue?

[dblythy]

I almost think it makes sense that a session token is not returned if a user is created in cloud code, as the session token has no use in cloud code. Perhaps we need to document this a little better.