Parse Dashboard can only be remotely accessed via HTTPS #46

tran-huy-phuc · 2016-03-05T02:05:42Z

After setting up the dashboard, I get the message "Parse Dashboard can only be remotely accessed via HTTPS".
I am hosting my backend on Digital Ocean (my domain is from Godaddy, but I didn't point to my IP yet), my dashboard url format: http://xxx.xxx.xxx.xxx:4040.
I am a mobile developer and I don't have experience on setting up https. Please tell me how to fix this!

drew-gross · 2016-03-05T02:14:01Z

If you are running the dashboard on your own laptop (localhost), this shouldn't be an issue. If you want to run the dashboard on a remote server, https is mandatory to prevent you from leaking your Master Key and completely compromising the security of your app. https://letsencrypt.org/ can help you get started with https for free, or you can just run the dashboard locally.

tran-huy-phuc · 2016-03-05T02:16:32Z

Thanks @drew-gross
If I set up a https on Godaddy and point it to my IP address, will it work?

drew-gross · 2016-03-05T02:23:46Z

That should work, but I haven't used SSL on GoDaddy so I can't be 100% sure. The connection to the express app that serves the dashboard must be secure, so as long as your setup on GoDaddy ensures you have a secure connection to dashboard, it will work. I'd recommend trying letsencrypt.org first, it's free so if it doesn't work then you haven't lost anything.

kevinbluer · 2016-03-22T16:10:42Z

Hi @thphuc, any luck getting this set this up?

tran-huy-phuc · 2016-03-22T16:22:28Z

Hi @kevinbluer
I followed these step and it worked:

Install parse-dashboard: npm install -g parse-dashboard
Create config file
Run this command: parse-dashboard --config parse-dashboard-config.json --allowInsecureHTTP
But this is for testing only, shouldn't use http for production

alexargo · 2016-05-03T17:09:06Z

I just got the dashboard set up on Heroku and am also getting this error even though I set the PARSE_DASHBOARD_ALLOW_INSECURE_HTTP environment variable to 1. I'm attempting to get it set up in Heroku like this as a node app that runs both the dashboard and the api/cloud code:

var api = new ParseServer({
  databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
  cloud: process.env.CLOUD_CODE_MAIN || __dirname + '/cloud/main.js',
  appId: process.env.APP_ID || 'myAppId',
  masterKey: process.env.MASTER_KEY || '', //Add your master key here. Keep it secret!
  serverURL: process.env.SERVER_URL || 'http://localhost:1337/parse',  // Don't forget to change to https if needed
  liveQuery: {
    classNames: ["Posts", "Comments"] // List of classes to support for query subscriptions
  }
});

var dashboard = new ParseDashboard({
  apps: [
    {
      appId: process.env.APP_ID || 'myAppId',
      masterKey: process.env.MASTER_KEY || 'myMasterKey',
      serverURL: process.env.SERVER_URL || 'http://localhost:1337/parse',
      appName: process.env.APP_NAME || 'MyApp',
    },
  ],
});

var app = express();

// Serve static assets from the /public folder
app.use('/public', express.static(path.join(__dirname, '/public')));

// Serve the Parse API on the /parse URL prefix
var mountPath = process.env.PARSE_MOUNT || '/parse';
app.use(mountPath, api);

// Serve the Parse API on the /dashboard
app.use('/dashboard/', dashboard);

var port = process.env.PORT || 1337;
var httpServer = require('http').createServer(app);
httpServer.listen(port, function() {
    console.log('parse-server-example running on port ' + port + '.');   
});

Any clue what I'm missing @drew-gross @kevinbluer ?

ghost · 2016-05-16T09:37:29Z

Hi, i Have a same issue, the variable "allowInsecureHTTPS" won't work in a configuration section in index.js.. where is the error?

`var express = require('express');
var ParseServer = require('parse-server').ParseServer;
var ParseDashboard = require('parse-dashboard');
var path = require('path');

var databaseUri = 'mongodb://......';

var api = new ParseServer({
databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
cloud: process.env.CLOUD_CODE_MAIN || __dirname + '/cloud/main.js',
appId: process.env.APP_ID || 'xxxx',
masterKey: process.env.MASTER_KEY || yyyy', //Add your master key here. Keep it secret!
serverURL: process.env.SERVER_URL || 'http://localhost:1337/parse', // Don't forget to change to https if needed
liveQuery: {
classNames: ["Posts", "Comments"] // List of classes to support for query subscriptions
}
});

var dashboard = new ParseDashboard({
"allowInsecureHTTP": true,
"apps": [
{
"serverURL": "http://localhost:1337/parse",
"appId": "xxx",
"masterKey": "yyy",
"appName": "appName"
}
],"users": [
{
"user":"user",
"pass":"pass"
}
]
});

var app = express();
`

warrenca · 2016-05-20T15:52:10Z

@milonet this worked for me

var config = {
  "allowInsecureHTTP": true,
  "apps": [
    {
      "serverURL": "http://localhost:1337/parse",
      "appId": "xxx",
      "masterKey": "yyy",
      "appName": "appName"
    }
  ],"users": [
    {
      "user":"user",
      "pass":"pass"
    }
  ]
};
var dashboard = new ParseDashboard(config, config.allowInsecureHTTP);

So the ParseDashboard class constructor accepts two parameters, first one if for the config file and second for allowInsecureHTTP flag. You can check out the code here.

alexargo · 2016-05-20T18:28:49Z

@warrenca I came to the same solution a few days ago. Seems like the environment variables and command line argument should work when running it as middleware too. I opened an issue for it: #361

holgerbrandl · 2017-08-14T11:52:23Z

None of the advice above seems applicable to the dockerized usage as detailed out under https://github.com/parse-community/parse-dashboard#run-with-docker

How can I work around the http/s issue when using docker image locally as described in the link?

paulfreeman · 2017-09-16T10:14:37Z

@holgerbrandl I'm having the same problem, runs fine locally outside Docker, but returns the same when running in Docker locally. There needs to be a way to pass in the allowInsecureHTTP config param into docker run for local use.

flovilmart · 2017-09-16T12:18:42Z

Yes the same way you pass the —port.

paulfreeman · 2017-09-17T11:46:39Z

THX @flovilmart I am trying docker run with -e allowInsecureHTTP='true' but that is not working (also tried. -e allowInsecureHTTP=true and -e allowInsecureHTTP:true).

flovilmart · 2017-09-17T13:39:17Z

-e is for environment vrairables , not for arguments.

paulfreeman · 2017-09-17T13:47:19Z

Sorry, there are several places that arguments could be provided, in Dockerfile and in docker run command and I'm not familiar with the right place or syntax for doing this. If you are able to give a brief example of how and where to do this it would be great as others are also having trouble with getting this to work.

flovilmart · 2017-09-17T15:26:59Z

@paulfreeman this is explained in the readme here https://github.com/parse-community/parse-dashboard/blob/master/README.md#run-with-docker

paulfreeman · 2017-09-17T15:42:43Z

Thanks again, I've tried that passing in --allowInsecureHTTP true as, but I still can't access the dashboard. If I run parse-dashboard locally everything works, but the dockerised version reports if can only be accessed via https.

My invocation is

docker run -it -p 4040:4040 --name dashboard --net mynetwork parse-dashboard --allowInsecureHTTP true

I've also tried

docker run -it -p 4040:4040 --name dashboard --net my network -v <fullyqualified>/parse-dashboard/parse-dashboard/config.json:/Parse-Dashboard/parse-dashboard-config.json parse-dashboard

with allowInsecureHTTP true set in config.json like this

{ "allowInsecureHTTP": true, "trustProxy": 1, "apps": [ { "serverURL": "http://myparseserver:1337/parse", "appId": "myAppId", "masterKey": "MKEY", "appName": "MyApp" } ] }

flovilmart · 2017-09-17T15:48:17Z

Can you try with just trustProxy set? This should be enough.

flovilmart · 2017-09-17T15:48:33Z

Also what version of the dashboard are you using?

paulfreeman · 2017-09-17T15:57:29Z

For the version, I pulled the master branch from git, then did the docker build. That version is running fine from the command line against my parse-server running on a user defined docker network.

flovilmart · 2017-09-17T16:48:59Z

That’s very odd indeed, you ca probably debunk this but putting a few logs here and there. We’re using that flag on google app engine without any issue.

paulfreeman · 2017-09-17T18:29:45Z

@flovilart thanks for your help, as you say I'll just have to see if I can get some logging to figure this out, I'm probably making some odd mistake somewhere. On the positive side this is a good way of learning how everything fits together.

holgerbrandl · 2017-09-18T13:03:54Z

Same with with me: I've build it from git on Aug 14. and I've provided allowInsecureHTTP as last position docker run argument as shown above in paulfreeman's posting, and it did not work.

Maybe you @flovilmart are running a different docker version? I'm using v17.06.

paulfreeman · 2017-09-18T13:54:23Z

@holgerbrandl I'm running 17.03.1-ce-rc1

swami701 · 2017-12-07T09:31:50Z

If anybody looking for the solution in the latest version. The below will work. A small change from @warrenca comment during the initialization code.

var config = {
  "allowInsecureHTTP": true,
  "apps": [
    {
      "serverURL": "http://localhost:1337/parse",
      "appId": "xxx",
      "masterKey": "yyy",
      "appName": "appName"
    }
  ],"users": [
    {
      "user":"user",
      "pass":"pass"
    }
  ]
};
var dashboard = new ParseDashboard(config, {allowInsecureHTTP: config.allowInsecureHTTP});

The change is

var dashboard = new ParseDashboard(config, {allowInsecureHTTP: config.allowInsecureHTTP});

instead of

var dashboard = new ParseDashboard(config, config.allowInsecureHTTP);

Now the app.js code from parse dashboard has been changed. You can find it here.

lidalao · 2017-12-24T04:55:39Z

@holgerbrandl
have the same issue, Do you have any solutions now?

zahisho · 2018-02-13T17:06:40Z

@swami701 solution worked for me. Use:
var dashboard = new ParseDashboard(config, {allowInsecureHTTP: config.allowInsecureHTTP});
Instead of:
var dashboard = new ParseDashboard(config, config.allowInsecureHTTP);

arvindr21 · 2018-09-01T16:09:25Z

For anyone looking to solve this via Docker setup

FROM node:8-slim
ENV NPM_CONFIG_LOGLEVEL error
WORKDIR /src
ADD . /src
RUN cd /src \
 && npm install \
 && npm run build \
 && npm cache clear --force \
 && rm -rf ~/.npm \
 && rm -rf /var/lib/apt/lists/*

ENV PARSE_DASHBOARD_ALLOW_INSECURE_HTTP=true

ENV PORT=4040

EXPOSE $PORT

ENTRYPOINT ["npm", "run", "dashboard"]

pahla1 · 2018-09-22T13:01:30Z

via docker setup:
pass -e PARSE_DASHBOARD_ALLOW_INSECURE_HTTP=true argument to docker run solve this problem.

warrenca · 2018-09-23T20:12:26Z

The solution to this was merged on #808, please refer to that.

manoj-singh-developer · 2019-05-10T06:29:12Z

The change is

app.use('/parse-dashboard', new ParseDashboard(config.dashboard, { allowInsecureHTTP: true }));

instead of

app.use('/parse-dashboard', ParseDashboard(config.dashboard, true));

you will find this code in index.js

Homolog

ptthien1012 · 2020-11-11T07:33:22Z

<3

InTheClodus · 2021-06-20T03:27:09Z

var config = {
"allowInsecureHTTP": true,
"apps": [
{
"serverURL": "http://localhost:1337/parse",
"appId": "xxx",
"masterKey": "yyy",
"appName": "appName"
}
],"users": [
{
"user":"user",
"pass":"pass"
}
]
};
var dashboard = new ParseDashboard(config, {allowInsecureHTTP: config.allowInsecureHTTP});

Thank you, this method is successful in my case. I don't need to pay for SSL certificate

drew-gross closed this as completed Mar 5, 2016

ghost mentioned this issue Jun 9, 2016

My web application was down when attaching dashboard. #402

Closed

2 tasks

joevo2 mentioned this issue Jul 11, 2016

Can we Install the dashboard on Heroku,? #159

Closed

douglasmuraoka pushed a commit that referenced this issue Nov 29, 2019

Merge pull request #46 from paivaric/homolog

6dfc3c5

Homolog

janoside added a commit to SunnySavannahs/parse-server that referenced this issue Aug 14, 2020

allow insecure. ref: parse-community/parse-dashboard#46

d4e2416

snyk-bot mentioned this issue Jun 12, 2022

refactor: upgrade otpauth from 7.1.2 to 7.1.3 #2163

Merged

snyk-bot mentioned this issue Jun 20, 2022

[Snyk] Security upgrade package-json from 2.4.0 to 7.0.0 enterstudio/parse-dashboard#1

Open

enterstudio mentioned this issue Jun 21, 2023

[Snyk] Security upgrade package-json from 2.4.0 to 7.0.0 enterstudio/parse-dashboard#3

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Parse Dashboard can only be remotely accessed via HTTPS #46

Parse Dashboard can only be remotely accessed via HTTPS #46

tran-huy-phuc commented Mar 5, 2016

drew-gross commented Mar 5, 2016

tran-huy-phuc commented Mar 5, 2016

drew-gross commented Mar 5, 2016

kevinbluer commented Mar 22, 2016

tran-huy-phuc commented Mar 22, 2016

alexargo commented May 3, 2016

ghost commented May 16, 2016

warrenca commented May 20, 2016

alexargo commented May 20, 2016

holgerbrandl commented Aug 14, 2017

paulfreeman commented Sep 16, 2017

flovilmart commented Sep 16, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017 •

edited

Loading

flovilmart commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017 •

edited

Loading

holgerbrandl commented Sep 18, 2017

paulfreeman commented Sep 18, 2017

swami701 commented Dec 7, 2017

lidalao commented Dec 24, 2017

zahisho commented Feb 13, 2018

arvindr21 commented Sep 1, 2018

pahla1 commented Sep 22, 2018

warrenca commented Sep 23, 2018

manoj-singh-developer commented May 10, 2019

ptthien1012 commented Nov 11, 2020

InTheClodus commented Jun 20, 2021

Parse Dashboard can only be remotely accessed via HTTPS #46

Parse Dashboard can only be remotely accessed via HTTPS #46

Comments

tran-huy-phuc commented Mar 5, 2016

drew-gross commented Mar 5, 2016

tran-huy-phuc commented Mar 5, 2016

drew-gross commented Mar 5, 2016

kevinbluer commented Mar 22, 2016

tran-huy-phuc commented Mar 22, 2016

alexargo commented May 3, 2016

ghost commented May 16, 2016

warrenca commented May 20, 2016

alexargo commented May 20, 2016

holgerbrandl commented Aug 14, 2017

paulfreeman commented Sep 16, 2017

flovilmart commented Sep 16, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017 • edited Loading

flovilmart commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017

flovilmart commented Sep 17, 2017

paulfreeman commented Sep 17, 2017 • edited Loading

holgerbrandl commented Sep 18, 2017

paulfreeman commented Sep 18, 2017

swami701 commented Dec 7, 2017

lidalao commented Dec 24, 2017

zahisho commented Feb 13, 2018

arvindr21 commented Sep 1, 2018

pahla1 commented Sep 22, 2018

warrenca commented Sep 23, 2018

manoj-singh-developer commented May 10, 2019

ptthien1012 commented Nov 11, 2020

InTheClodus commented Jun 20, 2021

paulfreeman commented Sep 17, 2017 •

edited

Loading

paulfreeman commented Sep 17, 2017 •

edited

Loading