Security for file uploads

[zdmano]

Issue Description

We've managed to set-up an S3 bucket without any issues and file uploads work great.

My main concern is that anyone can upload files to my bucket without any security .

I've searched all around and even looked through the adapter and haven't seen anywhere a security check .

Testing this it turn out that anyone can make file uploads to my bucket as long as they know my appID

Steps to reproduce

Setup an S3 bucket .

Make a POST request to upload a file.
For example :
curl -X POST -H "X-Parse-Application-Id: <APP_ID>" -H "Content-Type: text/plain" -T "D:\test.txt" http://localhost/parse/files/test.txt

Expected Results

An unauthorized error as long as no session token( or any other authentication method ) was provided in the header.

Actual Outcome

{
 "url":"http://localhost/parse/files/<APP_ID>/fc80b2e510c27d544b0d845ddcfc88e4_test.txt",
 "name":"fc80b2e510c27d544b0d845ddcfc88e4_test.txt"
}

Environment Setup

• Server
  • parse-server version: [2.2.13]
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): [Local && Heroku]

[flovilmart]

This is the expected behavior. Historically, on parse.com, the files upload is open to all clients.

I believe the behavior you're trying to achieve can be implemented through a hook, like beforeFileSave that would be called when receiving he file upload.

On another note, I'm not sure the client SDK's send authentication information (like the sessionToken) when uploading a file to the server.

You may wanna look into that too.

Feel free to open a pull request to add that feature.

[montymxb]

Closing as this is the normal behavior and is canon to how the original parse.com api functioned.

[kinosang]

Will beforeSave hook alive for Parse.File soon?

[flovilmart]

@kinosang this is not in the plans, however, if you wish to write a PR for it, we'll gladly review it.

[uzaysan]

Any progress on this? BeforeSave for Parse File would be really useful

[chongchungyin]

@kinosang @uzaysan you can have a look here https://docs.parseplatform.org/cloudcode/guide/#beforesavefile. For the usage you can have a look at the test cases.
https://github.com/parse-community/parse-server/blob/62048260c9b834f5a7d806b9970dd051408f9887/spec/CloudCode.spec.js