Version 2.2.24 and above breaks Parse.File.save() - unauthorized

[MartinHerman]

Hi everyone,
I think the the recent changes in v2.2.24 regarding "Better support for checking application and client keys" have broken the save() method for saving Parse.Files.

This is very likely related to my other issue #3051, which I think has since been resolved in v2.2.25.

This code worked in v2.2.23 and below:

//Getting Logo Image from Parse.Cloud.httpRequest
var logoFilename = "logo.png";
var logoFile = new Parse.File(logoFilename, {base64: httpImageFile.buffer.toString('base64')})

//Save logoFile
logoFile.save();

In v2.2.24 and above, I'm now getting unauthorized, even if I pass save({useMasterKey : true}). Again, as in #3051, VERBOSE shows nothing.

I pass all keys in constructor of ParseServer - as @steven-supersolid suggested in #3051.

Saving from the iOS client app however still works...

[Cliffordwh]

If its cloud based, you need to pass the Javascript key in your config!

How are you initializing the server? Pm2?

[MartinHerman]

@Cliffordwh - As I've said, I'm passing all keys - masterKey, clientKey, restAPIKey, javascriptKey, dotNetKey when creating the constructor.

When I'm testing my Cloud Code Function that contains the Parse.File save(), I'm using curl with the REST endpoint /functions/my_function/ and passing the REST key as X-Parse-REST-API-Key in the header.

[Cliffordwh]

There's your problem. Pass the X-Parse-Application-Id as well. That will resolve it!

[MartinHerman]

@Cliffordwh - also passing that, and passing X-Parse-Session-Token if I want to simulate an authenticated user.

[Cliffordwh]

mmm thats strange. Sorry to ask, but you 100% sure there is no typo when creating the constructor and the keys correspond?

Could i ask you to curl without the X-Parse-Session-Token to see if you get a response?

[MartinHerman]

@Cliffordwh - I'm 100% sure there is not typo. Not including X-Parse-Session-Token just returns the same unauthorized, as I'm not passing save({useMasterKey : true}) - which apparently is ignored anyway.

[Cliffordwh]

@MartinHerman the only last suggestion i can give is to remove client_key from the header.

I found this comment in a thread.

Then tried to include X-Parse-Client-Key in the request header (same value that is passed to server in index.js) and it does not work.
Then I removed the client key in the server initialisation (the code clientKey: process.env.CLIENT_KEY || '',) and it worked !!!

[MartinHerman]

@Cliffordwh - I'm not passing a clientKey in the header. We can't remove it from the ParseServer constructor, as we're also using it for the mobile apps.

[Cliffordwh]

Sorry, i thought you said you where passing all keys. im trying to replicate this with little success.

[Cliffordwh]

Can you run with VERBOSE=1 to gather the server logs and paste them here?

[Cliffordwh]

Also check and make sure you passing serverURL

[hedegren]

You need to do this (add null):

logoFile.save(null, {useMasterKey:true});

[MartinHerman]

@Cliffordwh - as I've already stated, VERBOSE shows nothing. The ServerURL is right as well, as all other calls work.

@hedegren - this is the standard format for Parse.Objects - however Parse.File.save() only wants one parameter, as per API reference.

[hedegren]

@MartinHerman True, however it seems that you must include the null as first parameter regardless what the docs says. Try it out and see for yourself.

[flovilmart]

@hedegren save() on file only take one argument:

https://github.com/ParsePlatform/Parse-SDK-JS/blob/master/src/ParseFile.js#L164