Skip to content

Commit db0fd81

Browse files
dblythydblythy
committed
update
1 parent 0e4e3c0 commit db0fd81

File tree

7 files changed

+807
-264
lines changed

7 files changed

+807
-264
lines changed

‎_includes/parse-server/backers.md

Lines changed: 0 additions & 46 deletions
This file was deleted.

‎_includes/parse-server/configuration.md

Lines changed: 210 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,210 @@
1+
## Configuration
2+
3+
Parse Server can be configured using the following options. You may pass these as parameters when running a standalone `parse-server`, or by loading a configuration file in JSON format using `parse-server path/to/configuration.json`. If you're using Parse Server on Express, you may also pass these to the `ParseServer` object as options.
4+
5+
For the full list of available options, run `parse-server --help` or take a look at [Parse Server Configurations](http://parseplatform.org/parse-server/api/master/ParseServerOptions.html).
6+
7+
## Basic Options
8+
9+
* `appId`: A unique identifier for your app.
10+
* `databaseURI`: Connection string URI for your MongoDB.
11+
* `cloud`: Path to your app’s Cloud Code.
12+
* `masterKey`: A key that overrides all permissions. Keep this secret.
13+
* `serverURL`: URL to your Parse Server (don't forget to specify http:// or https://). This URL will be used when making requests to Parse Server from Cloud Code.
14+
* `port`: The default port is 1337, specify this parameter to use a different port.
15+
* `push`: An object containing push configuration. See [Push](#push-notifications)
16+
* `auth`: Configure support for [3rd party authentication](#oauth-and-3rd-party-authentication).
17+
18+
For the full list of available options, run `parse-server --help` or refer to [Parse Server Options](https://parseplatform.org/parse-server/api/master/ParseServerOptions.html) for a complete list of configuration options.
19+
20+
The Parse Server object was built to be passed directly into `app.use`, which will mount the Parse API at a specified path in your Express app:
21+
22+
```js
23+
const express = require('express');
24+
const ParseServer = require('parse-server').ParseServer;
25+
26+
const app = express();
27+
const api = new ParseServer({ ... });
28+
29+
// Serve the Parse API at /parse URL prefix
30+
app.use('/parse', api);
31+
32+
var port = 1337;
33+
app.listen(port, function() {
34+
console.log('parse-server-example running on port ' + port + '.');
35+
});
36+
```
37+
38+
And with that, you will have a Parse Server running on port 1337, serving the Parse API at `/parse`.
39+
40+
## Additional Options
41+
42+
### Email verification and password reset
43+
44+
Verifying user email addresses and enabling password reset via email requires an email adapter.
45+
46+
You can also use email adapters contributed by the community such as:
47+
- [parse-server-mailgun-adapter-template](https://www.npmjs.com/package/parse-server-mailgun-adapter-template)
48+
- [parse-smtp-template (Multi Language and Multi Template)](https://www.npmjs.com/package/parse-smtp-template)
49+
- [parse-server-postmark-adapter](https://www.npmjs.com/package/parse-server-postmark-adapter)
50+
- [parse-server-sendgrid-adapter](https://www.npmjs.com/package/parse-server-sendgrid-adapter)
51+
- [parse-server-mandrill-adapter](https://www.npmjs.com/package/parse-server-mandrill-adapter)
52+
- [parse-server-simple-ses-adapter](https://www.npmjs.com/package/parse-server-simple-ses-adapter)
53+
- [parse-server-sendinblue-adapter](https://www.npmjs.com/package/parse-server-sendinblue-adapter)
54+
- [parse-server-mailjet-adapter](https://www.npmjs.com/package/parse-server-mailjet-adapter)
55+
- [simple-parse-smtp-adapter](https://www.npmjs.com/package/simple-parse-smtp-adapter)
56+
- [parse-server-generic-email-adapter](https://www.npmjs.com/package/parse-server-generic-email-adapter)
57+
58+
The Parse Server Configuration Options relating to email verifcation are:
59+
60+
* `verifyUserEmails`: whether the Parse Server should send mail on user signup
61+
* `emailVerifyTokenValidityDuration`: how long the email verify tokens should be valid for
62+
* `emailVerifyTokenReuseIfValid`: whether an existing token should be resent if the token is still valid
63+
* `preventLoginWithUnverifiedEmail`: whether the Parse Server should prevent login until the user verifies their email
64+
* `publicServerURL`: The public URL of your app. This will appear in the link that is used to verify email addresses and reset passwords.
65+
* `appName`: Your apps name. This will appear in the subject and body of the emails that are sent.
66+
* `emailAdapter`: The email adapter.
67+
68+
```js
69+
const api = ParseServer({
70+
...otherOptions,
71+
verifyUserEmails: true,
72+
emailVerifyTokenValidityDuration: 2 * 60 * 60, // in seconds (2 hours = 7200 seconds)
73+
preventLoginWithUnverifiedEmail: false, // defaults to false
74+
publicServerURL: 'https://example.com/parse',
75+
appName: 'Parse App',
76+
emailAdapter: {
77+
module: '@parse/simple-mailgun-adapter',
78+
options: {
79+
fromAddress: '[email protected]',
80+
domain: 'example.com',
81+
apiKey: 'key-mykey',
82+
}
83+
},
84+
});
85+
```
86+
Note:
87+
88+
* If `verifyUserEmails` is `true` and if `emailVerifyTokenValidityDuration` is `undefined` then email verify token never expires. Else, email verify token expires after `emailVerifyTokenValidityDuration`.
89+
90+
### Account Lockout
91+
92+
Account lockouts prevent login requests after a defined number of failed password attempts. The account lock prevents logging in for a period of time even if the correct password is entered.
93+
94+
If the account lockout policy is set and there are more than `threshold` number of failed login attempts then the `login` api call returns error code `Parse.Error.OBJECT_NOT_FOUND` with error message `Your account is locked due to multiple failed login attempts. Please try again after <duration> minute(s)`.
95+
96+
After `duration` minutes of no login attempts, the application will allow the user to try login again.
97+
98+
*`accountLockout`: Object that contains account lockout rules
99+
*`accountLockout.duration`: Determines the number of minutes that a locked-out account remains locked out before automatically becoming unlocked. Set it to a value greater than 0 and less than 100000.
100+
*`accountLockout.threshold`: Determines the number of failed sign-in attempts that will cause a user account to be locked. Set it to an integer value greater than 0 and less than 1000.
101+
102+
```js
103+
const api = ParseServer({
104+
...otherOptions,
105+
accountLockout: {
106+
duration: 5,
107+
threshold: 3
108+
}
109+
});
110+
```
111+
112+
### Password Policy
113+
114+
Password policy is a good way to enforce that users' passwords are secure.
115+
116+
Two optional settings can be used to enforce strong passwords. Either one or both can be specified.
117+
118+
If both are specified, both checks must pass to accept the password
119+
120+
1. `passwordPolicy.validatorPattern`: a RegExp object or a regex string representing the pattern to enforce
121+
2. `passwordPolicy.validatorCallback`: a callback function to be invoked to validate the password
122+
123+
The full range of options for Password Policy are:
124+
125+
*`passwordPolicy` is an object that contains the following rules:
126+
*`passwordPolicy.validationError`: optional error message to be sent instead of the default "Password does not meet the Password Policy requirements." message.
127+
*`passwordPolicy.doNotAllowUsername`: optional setting to disallow username in passwords
128+
*`passwordPolicy.maxPasswordAge`: optional setting in days for password expiry. Login fails if user does not reset the password within this period after signup/last reset.
129+
*`passwordPolicy.maxPasswordHistory`: optional setting to prevent reuse of previous n passwords. Maximum value that can be specified is 20. Not specifying it or specifying 0 will not enforce history.
130+
*`passwordPolicy.resetTokenValidityDuration`: optional setting to set a validity duration for password reset links (in seconds)
131+
*`passwordPolicy.resetTokenReuseIfValid`: optional setting to resend current token if it's still valid
132+
133+
```js
134+
const validatePassword = password => {
135+
if (!password) {
136+
return false;
137+
}
138+
if (password.includes('pass')) {
139+
return false;
140+
}
141+
return true;
142+
}
143+
const api = ParseServer({
144+
...otherOptions,
145+
passwordPolicy: {
146+
validatorPattern: /^(?=.*[a-z])(?=.*[A-Z])(?=.*[0-9])(?=.{8,})/, // enforce password with at least 8 char with at least 1 lower case, 1 upper case and 1 digit
147+
validatorCallback: (password) => { return validatePassword(password) },
148+
validationError: 'Password must contain at least 1 digit.',
149+
doNotAllowUsername: true,
150+
maxPasswordAge: 90,
151+
maxPasswordHistory: 5,
152+
resetTokenValidityDuration: 24*60*60,
153+
resetTokenReuseIfValid: true
154+
}
155+
});
156+
```
157+
158+
159+
### Custom Pages
160+
161+
It’s possible to change the default pages of the app and redirect the user to another path or domain.
162+
163+
```js
164+
const api = ParseServer({
165+
...otherOptions,
166+
customPages: {
167+
passwordResetSuccess: "http://yourapp.com/passwordResetSuccess",
168+
verifyEmailSuccess: "http://yourapp.com/verifyEmailSuccess",
169+
parseFrameURL: "http://yourapp.com/parseFrameURL",
170+
linkSendSuccess: "http://yourapp.com/linkSendSuccess",
171+
linkSendFail: "http://yourapp.com/linkSendFail",
172+
invalidLink: "http://yourapp.com/invalidLink",
173+
invalidVerificationLink: "http://yourapp.com/invalidVerificationLink",
174+
choosePassword: "http://yourapp.com/choosePassword"
175+
}
176+
})
177+
```
178+
179+
## Insecure Options
180+
181+
When deploying to be production, make sure:
182+
183+
* `allowClientClassCreation` is set to `false`
184+
* `mountPlayground` is not set to `true`
185+
* `masterKey` is set to a long and complex string
186+
* `readOnlyMasterKey` if set, is set to a long and complex string
187+
* That you have authentication required on your database, and, if you are using mongo, disable unauthenticated access to port 27017
188+
* You have restricted `count` and `addField` operations via [Class Level Permissions](#class-level-permissions)
189+
* You enforce ACL and data validation using [cloud code]({{site.baseURL}}/cloudcode/guide/)
190+
191+
## Using environment variables to configure Parse Server
192+
193+
You may configure the Parse Server using environment variables:
194+
195+
```bash
196+
PORT
197+
PARSE_SERVER_APPLICATION_ID
198+
PARSE_SERVER_MASTER_KEY
199+
PARSE_SERVER_DATABASE_URI
200+
PARSE_SERVER_URL
201+
PARSE_SERVER_CLOUD
202+
```
203+
204+
The default port is 1337, to use a different port set the PORT environment variable:
205+
206+
```bash
207+
$ PORT=8080 parse-server --appId APPLICATION_ID --masterKey MASTER_KEY
208+
```
209+
210+
For the full list of configurable environment variables, run `parse-server --help` or take a look at [Parse Server Configuration](https://github.com/parse-community/parse-server/blob/master/src/Options/Definitions.js).

‎_includes/parse-server/experimental.md

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -8,6 +8,14 @@ These features may not be approprate for production, so use at your own risk.
88

99
* `directAccess`: Replaces HTTP Interface when using JS SDK in current node runtime. This may improve performance, along with `enableSingleSchemaCache` set to `true`.
1010

11+
Configuration:
12+
```js
13+
const api = new ParseServer({
14+
//...other configuration
15+
directAccess: true
16+
});
17+
```
18+
1119
## Idempotency
1220

1321
This feature deduplicates identical requests that are received by Parse Server mutliple times, typically due to network issues or network adapter access restrictions on mobile operating systems.
@@ -18,14 +26,15 @@ This feature needs to be enabled on the client side to send the header and on th
1826

1927
Deduplication is only done for object creation and update (`POST` and `PUT` requests). Deduplication is not done for object finding and deletion (`GET` and `DELETE` requests), as these operations are already idempotent by definition.
2028

21-
Configutation:
29+
Configuration:
2230
```js
23-
let api = new ParseServer({
31+
const api = new ParseServer({
32+
//...other configuration
2433
idempotencyOptions: {
2534
paths: [".*"], // enforce for all requests
2635
ttl: 120 // keep request IDs for 120s
2736
}
28-
}
37+
});
2938
```
3039
Parameters:
3140

0 commit comments

Comments
 (0)