Add support for non-revocable sessions

[steven-supersolid]

parse-server currently only supports revocable sessions but my live app uses legacy sessions. While there is some documentation about migrating sessions for a parse.com app, it is not clear what will happen when switching to parse-server. I would like to minimise changes when migrating my live app to parse-server.

I will do some tests on this and maybe submit a PR but have not examined the code in any detail yet. Legacy sessions could give a potential performance increase as the _Session collection would not be used in any requests.

[flovilmart]

non revocable session have been deprecated as they are quite insecure, I'm not sure we want to get those back

[steven-supersolid]

I wouldn't say insecure, just less secure in that once a token is known the account can be accessed indefinitely. This was good enough for Parse until March 2015 and I could not find an announcement about deprecation, just that they are no longer the default.

Revocable sessions were not fully supported in Unity clients until recently because Unity had a bug with HTTP errors not being handled correctly. This meant that a invalid session error would look like any other HTTP error so the client could have no special logout handling without applying it to all errors. This also meant that enabling revocable sessions with a Unity client was a risk in case Parse had an issue retrieving from _Session.

Short term, the goal for me is for my app to work with parse-server exactly the same as it works on Parse.com, and I imagine this is shared by a lot of Parse customers.

In my test, using a non-revocable session token on a Cloud Code call resulted in request.user being undefined. This can be caught and then logout/login requested on the client but login is not always straightforward. Overall this not as smooth as the background migration procedure describe in this guide: https://www.parse.com/tutorials/session-migration-tutorial

I also tested using a parse-server issued non-revocable token with a Parse.com hosted app (using the same database) and this worked fine. This means that users will at least not have to log back in if the server needs to be switched back due to a critical bug.

[ralphilius]

+1 for this since we need this to implement social login which needs to fetch user's session for become method call. Please direct me a solution if any.

http://stackoverflow.com/questions/33492263/how-to-create-a-parse-user-account-from-a-android-google-token/33631230

[hramos]

Non-revocable sessions were deprecated with the launch of revocable sessions on March 25 last year. Apps created after March 25, 2015 can only use revocable sessions.

This issue only affects apps that have not migrated to the new, more secure session model. Instead of working around it by implementing the older session model in Parse Server, we suggest following our migration guide and migrating your user sessions to the newer revocable model.

[ralphilius]

@hramos Can we login a user without knowing a password?

[flovilmart]

@ralphilius you Can definitely write your own custom login logic through the Oauth adapters. You need 1 method to validated the authData passed through the Oauth login, and pass the ID of your 3rd party Auth. It don't have to be Oauth explicitly.

We also have oauth for Google provided by parse server. Right away.

[ralphilius]

@flovilmart I have seen the google oauth, but I don't get it how these adapters are called by clients and how they return required data (session/username & password) to clients log in. Sorry to ask but I don't get the big picture of this implementation yet.

Thanks for support.

[flovilmart]

You have to gather the auth token and user ID on the client. Then send those through the link method. The server will validate the auth token through the Google API, and on subsequent login, match the Google user ID you provided with the one initially provided upon linking or login.

[ralphilius]

OK. For Java, I should call logInWithInBackground(String authType, Map<String,String> authData) right?

Please see this example:

String authType = "google";
Map<String, String> authData = new HashMap<>();
authData.put("access_token", "RETRIEVED_ACCESS_TOKEN");
ParseUser.logInWithInBackground(authType, authData);

I have only one doubt about the authData.id in google oauth. Is it user's email or Google Account Id?

[flovilmart]

It should be what corresponds to the user_id returned by the API Call. Most likely the Google account ID

[flovilmart]

See https://developers.google.com/identity/protocols/OAuth2UserAgent#validatetoken

[steven-supersolid]

@hramos I cannot find any announcement that non-revocable sessions are deprecated. The blog post talks about revocable sessions being "Enhanced Sessions", i.e. a recommended improvement rather than a replacement. While new apps do default to revocable sessions, it is possible to switch back on the General Settings page.

Nothing will change for new apps if we add non-revocable session support and I agree that revocable sessions are a good idea and should be the default. I simply wish to add support for the existing Parse.com session handling.

[ewindso]

@steven-supersolid I needed this support and added a PR here: #1749