Error 206 cannot modify user for new Facebook user

[ashish-naik]

Hello

I am getting error 206 after new Facebook user is saved and reason seems to be nil sessionToken.
I am facing this for Apple sign in also randomly. This is probably getting fixed by #6416. Don't know whether Facebook issue will also be fixed.

I have one old account created on Heroku Parse server which works fine ie i am able to save attributes after login.

I was running server v3.9.0. tried upgrading till 4.0.2 but still failing.

I am updating PFUser object post login locally in iOS client using Swift. Not using cloud code for this.

Also failing on back4app v3.9.0. Sign in with Apple also failing on back4app but works randomly.

Works on local setup consistently. Local server installed using bootstrap.sh script.

I have seen some issued dated 2016 fixing this error but server code seems to have changed lot so cannot view the same code referred in #952

using FBSDKCoreKit 5.15.1, FBSDKLoginKit 5.15.1

Steps to reproduce

on iOS, Try login using a facebook account that is not yet created on Parse.
Running iOS 13.3.1

Expected Results

After successful login, should be able to save other attributes in PFUser.current() object

Actual Outcome

The login is successful but saving any attributes fails with error 206 "cannot modify user xxxxx"
Fails on back4app also. v3.9.0
Both Apple and Facebook new user registration and update work fine in local environment.

Environment Setup

• Server

  • parse-server version (Be specific! Don't say 'latest'.) : 3.9.0 to 4.0.2 (Local 3.10.0)
  • Operating System: heroku-18 (Local MacOS 10.15.3)
  • Hardware: heroku-18 (Local MacOS 10.15.3)
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): Both as mentioned above

• Database

  • MongoDB version: mLab 3.6.12 (Local 4.2.3)
  • Storage engine: mLab
  • Hardware: mLab
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): both

Logs/Trace

Mar 15 02:51:40 yovl app/web.1 error: Parse error: Cannot modify user kc30Xbk1wA. {"code":206,"stack":"Error: Cannot modify user kc30Xbk1wA.\n at RestWrite.runDatabaseOperation (/app/node_modules/parse-server/lib/RestWrite.js:1170:11)\n at /app/node_modules/parse-server/lib/RestWrite.js:127:17\n at processTicksAndRejections (internal/process/task_queues.js:97:5)"}

package.json used for deployment to Heroku

{
  "name": "parse-server-example",
  "version": "1.4.0",
  "description": "Based on example Parse API server using the parse-server module",
  "main": "index.js",
  "repository": {
    "type": "git",
    "url": "https://github.com/ashish-naik/parse-server.git"
  },
  "license": "MIT",
  "dependencies": {
    "express": "4.17.1",
    "parse-server": "4.1.0",
    "underscore":"*",
    "parse": "2.11.0"
  },
  "scripts": {
    "start": "node index.js"
  },
  "engines": {
    "node": ">= 8",
    "npm": ">= 5.7.1"
  }
}

auth section in index.js

auth: {
    facebook: {
      appIds: process.env.FACEBOOK_APP_ID
    },
    apple: {
      
      client_id: process.env.IOS_BUNDLE_ID 
    }
  },

[henrytkirk]

I'm having a similar issue too - perhaps related:
If I login with Facebook successfully, then logout and try Sign-in with Apple using the same email associated with Facebook, I get a 500 returned - internal server error.

[dplewis]

@henrytkirk Can you open a new issue and fill out the template. Any logs or sample code would help.

[dplewis]

@ashish-naik Can you try facebook login on the backend with masterKey: true?

[ashish-naik]

I am not using cloud code for login. Call from swift code.

[dplewis]

I wanted you to try it and see if that would fix this

If login is successful does your current user have a sessionToken? To change a user you need to have permission to do so.

[ashish-naik]

I will try. May take some time due to workplace priorities.

Yes sessionToken is nil after successful login.

[ashish-naik]

@dplewis I tried below. Not good with cloud code so hope code is not wrong.

Cloud function

Parse.Cloud.define("loginWithFacebook", function(request) {

  var params = request.params
  var authData = params.authData
  var id = params.id
  var expiredBy = params.expiredBy

  var facebookAuthData = {
    "id": id,
    "access_token": authData,
    "expiration_date": expiredBy
  }

  Parse.FacebookUtils.logIn(facebookAuthData, { useMasterKey: true }) 
    .then(function(user) {
        if (user.isNew()) {
            console.log("NEW User logged in with id " + user.id + " with session token : " + user.sessionToken)
        } else {
          console.log("Existing User logged in with id " + user.id + " with session token : " + user.sessionToken)
        }
    })
    .catch(function(error) {
      console.log('ERROR','loginWithFacebook() - Error with facebook login : '+ error);
      throw error
    })
  
})

ios Code

func processFBLogin() {
        
        if let accessToken = AccessToken.current {
            
            logger.debug("Facebook user logged in with toke \(accessToken.appID)- \(accessToken.tokenString)")
            
            PFCloud.callFunction(inBackground: "loginWithFacebook", withParameters: ["id":accessToken.userID, "authData":accessToken.tokenString, "expiredBy":accessToken.expirationDate], block: {
                
                (response: Any?, error: Error?) -> Void in
                
                if error == nil {

                    if let loggedinUser = PFUser.current() {
                        logger.debug("FB login successful - sessiontoken \(loggedinUser.sessionToken) ")
                    } else {
                        
                        logger.debug("FB login failed ")
                        
                    }

                } else {
                    
                    logger.error("Error with facebook login \(String(describing: error?.localizedDescription))")
                }
            })
            
        } else {
            
            logger.info("No FB token available")
        }

    }

Server log

 info: Ran cloud function loginWithFacebook for user undefined with:
   Input: {"id":"xxxxxxxxxx","expiredBy":"2020-05-24T15:48:42.018Z","authData":"adasdasdasdasdasdasda"}
   Result: undefined {"functionName":"loginWithFacebook","params":{"id":"xxxxxxxxxx","expiredBy":"2020-05-24T15:48:42.018Z","authData":"adasdasdasdasdasdasda"}}
 verbose: RESPONSE from [POST] /parse/functions/loginWithFacebook: {
   "response": {}
 } {"result":{"response":{}}}
 verbose: REQUEST for [POST] /parse/users: {
   "authData": {
     "facebook": {
       "id": "xxxxxxxxxx",
       "access_token": "adasdasdasdasdasdasda",
       "expiration_date": {
         "__type": "Date",
         "iso": "2020-05-24T15:48:42.018Z"
       }
     }
   }
 } {"method":"POST","url":"/parse/users","headers":{"host":"myApp.herokuapp.com","connection":"close","user-agent":"node-XMLHttpRequest, Parse/js2.11.0 (NodeJS 13.11.0)","accept":"*/*","content-type":"text/plain","x-request-id":"c9ec003f-70c6-4b03-bb2e-acbda997836b","x-forwarded-for":"54.92.152.225","x-forwarded-proto":"https","x-forwarded-port":"443","via":"1.1 vegur","connect-time":"1","x-request-start":"1585152709435","total-route-time":"0","content-length":"569"},"body":{"authData":{"facebook":{"id":"xxxxxx","access_token":"adasdasdasdasdasdasda","expiration_date":{"__type":"Date","iso":"2020-05-24T15:48:42.018Z"}}}}}
 heroku/router at=info method=POST path="/parse/functions/loginWithFacebook" host=myApp.herokuapp.com request_id=2d5de5a0-f465-4387-aa7a-e4c3f575566c fwd="122.169.14.163" dyno=web.1 connect=1ms service=14ms status=200 bytes=625 protocol=https
 heroku/router at=info method=POST path="/parse/users" host=myApp.herokuapp.com request_id=c9ec003f-70c6-4b03-bb2e-acbda997836b fwd="54.92.152.225" dyno=web.1 connect=1ms service=298ms status=201 bytes=794 protocol=https
 verbose: RESPONSE from [POST] /parse/users: {
   "status": 201,
   "response": {
     "objectId": "efsyICJCAq",
     "createdAt": "2020-03-25T16:11:49.440Z",
     "username": "hDTtBCA6oSpZGDR7a9kpemoFC"
   },
   "location": "http://myApp.herokuapp.com/parse/users/efsyICJCAq"
 } {"result":{"status":201,"response":{"objectId":"efsyICJCAq","createdAt":"2020-03-25T16:11:49.440Z","username":"sdfsdfsdfsdf"},"location":"http://myApp.herokuapp.com/parse/users/efsyICJCAq"}}
 Existing User logged in with id efsyICJCAq with session token : undefined

if i run code for a registered user without master key, i get sessionToken printed in logs.

But i am getting undefined for sessionToken for user.sessionToken or user.getsessionToken.
Not sure to fetch access token.

Moreover, in Xcode i get PFUser.current as nil.

Does above help?

[ashish-naik]

@dplewis Did you get a chance to look at my code?

Hope you are safe and doing well in this difficult times.

[dplewis]

I can look into it, can you open a similar post in the iOS SDK?

[ashish-naik]

Created parse-community/Parse-SDK-iOS-OSX#1492

[ashish-naik]

@dplewis I had opened 1477 post awhile back for Sign in with Apple. The symptoms are same as Facebook login issue that i created for you to look at. I have added some details of investigation there but realized it is marked closed. Can you please have a look? Should i remove the details from there and repost here?

[ashish-naik]

@dplewis did you get a chance to check? Although you asked me to open this issue in iOS SDK repo (which i did, linked above), i think this has to do with server.

I am stuck at this since many days. Really appreciate if you could take a look.

Today i tested on local server on my Mac with same config as Heroku ie
npm v 6.13.7
node v 9.4.0
parse server 4.2.0

it worked on local but didnt on Heroku. I noticed that this.storage['authprovider'] is undefined in createSessionTokenIfNeeded to createSessionToken() isnt called.

RestWrite.prototype.createSessionTokenIfNeeded = function() {

logger.info('Message - createSessionTokenIfNeeded - For class - ' + this.className)
  if (this.className !== '_User') {
    return;
  }
  // Don't generate session for updating user (this.query is set) unless authData exists
  if (this.query && !this.data.authData) {
    return;
  }
  logger.info('Message - createSessionTokenIfNeeded - Not update call - going ahead')

  // Don't generate new sessionToken if linking via sessionToken
  if (this.auth.user && this.data.authData) {
    return;
  }
  logger.info('Message - createSessionTokenIfNeeded - not linking so going ahead')

  if (
    !this.storage['authProvider'] && // signup call, with (THIS IS FAILING)
    this.config.preventLoginWithUnverifiedEmail && // no login without verification
    this.config.verifyUserEmails
  ) {
    // verification is on
    logger.info('Message - createSessionTokenIfNeeded - returning as no auth provider, preventLoginWihoutEmail, verifyEmail')   
    logger.info('Message - createSessionTokenIfNeeded - authProvider = ' + this.storage['authProvider'] + ' preventLoginWihoutEmail = ' + this.config.preventLoginWithUnverifiedEmail + ' verifyUserEmails = ' + this.config.verifyUserEmails)
    return; // do not create the session token in that case!
  }
  logger.info('Message - createSessionTokenIfNeeded - before calling - return this.createSessionToken()' )

  return this.createSessionToken();
};