@@ -620,13 +620,9 @@ the user's credentials. The Parse REST API supports these use cases with the
620
620
` /loginAs ` endpoint. This endpoint takes a ` userId ` parameter, and must be
621
621
called using the master key. It will create a session for the given user ID, and
622
622
will return the same response format as the ` /login ` endpoint. The new session
623
- will have a ` createdWith ` value of ` create ` , and an ` authProvider ` value of
623
+ will have a ` createdWith ` value of ` login ` , and an ` authProvider ` value of
624
624
` masterkey ` .
625
625
626
- ** The ` /loginAs ` endpoint performs no identity verification** - any client with
627
- the master key can log in as any user. You are strongly encouraged to apply
628
- careful security around any systems that call the ` /loginAs ` endpoint.
629
-
630
626
<div class =" language-toggle " >
631
627
<pre ><code class =" bash " >
632
628
curl -X GET \
@@ -654,10 +650,8 @@ print result
654
650
</code ></pre >
655
651
</div >
656
652
657
- At this time, the ` /loginAs ` endpoint does not run the ` beforeLogin ` or
658
- ` afterLogin ` hooks that would be invoked when calling the ` /login ` endpoint.
653
+ The ` /loginAs ` endpoint does not run the ` beforeLogin ` or ` afterLogin ` hooks
654
+ that would be invoked when calling the ` /login ` endpoint.
659
655
660
- Since the master key must always be supplied with any request to ` /loginAs ` ,
661
- this action will always succeed if the supplied user id exists in the database.
662
- The endpoint does not honor account lockouts - developers must check for that
663
- manually if appropriate for their use case.
656
+ This action will always succeed if the supplied user id exists in the database,
657
+ regardless of whether the user is locked out.
0 commit comments