Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

🐣 New Feature: Security Check #7288

Closed
mtrezza opened this issue Mar 21, 2021 · 0 comments
Closed

🐣 New Feature: Security Check #7288

mtrezza opened this issue Mar 21, 2021 · 0 comments
Labels
type:meta Non-code issue

Comments

@mtrezza
Copy link
Member

mtrezza commented Mar 21, 2021

🛡 Security Check

We want make it easier for you to secure your Parse Server. The new Security Check feature allows you to easily identify weak security settings in your Parse Server deployment. This helps you to secure existing Parse Server apps, but also to transition new apps from a playground environment, in which security settings are often deliberately weak for easy development, to a secure production environment. The feature comes with built-in security checks and also allows you to write custom checks for your application.

Features

  • New security endpoint https://example.com/parse/security that returns security report in JSON format (requires master key)
  • Optional output of security report into log file on Parse Sever start
  • Customizable, allows to override built-in / add custom security checks via Parse Server configuration
  • Modular design, checks run only on demand, no constant load on Parse Server

ℹ️ Adding a security check is now mandatory for security relevant PRs to increase the security coverage. There are still many existing settings that are not yet checked, so please feel free to submit a new check to be added to the built-in checks. If you are interested in seeing the security report conveniently as a Parse Dashboard page, please join the PR.

Usage

To enable the Security Check set the Parse Server configuration security.enableCheck: true.

const server = new ParseServer({
  security: {
    enableCheck: true,     // Enables security checks including `/security` endpoint
    enableCheckLog: true,  // Enables log output; required to auto-run security check on server start
    checkGroups: [ ... ]   // Custom security checks
  },
  ...otherOptions
});

Example security report log output:

###################################
#                                 #
#   Parse Server Security Check   #
#                                 #
###################################

Warning: 1 weak security setting(s) found!
2 check(s) executed
0 check(s) skipped

- Parse Server Configuration
   ✅ Secure master key
   ❌ Security log disabled
      Warning: Security report in log. Set Parse Server configuration `security.enableCheckLog` to false.

The report returned by the /security endpoint follows this schema:

{
    report: {
      version: "1.0.0", // The report version, defines the schema
      state: "fail"     // The disjunctive indicator of failed checks in all groups.
      groups: [         // The check groups
        {
          name: "House",            // The group name
          state: "fail"             // The disjunctive indicator of failed checks in this group.
          checks: [                 // The checks
            title: "Door locked",   // The check title
            state: "fail"           // The check state
            warning: "Anyone can enter your house."   // The warning.
            solution: "Lock your door."               // The solution.
          ]
        },
        ...
      ]
    }
}

Factsheet

Previous Feature Spotlights

About

  • This issue is only intended to inform. If you encounter a bug or have a suggestion please open a new issue.
  • This is a pilot for a new series in which we move different notable feature addition or improvement into the spotlight.
  • Got feedback regarding this series? - Post in the Community Forum.
@mtrezza mtrezza pinned this issue Mar 21, 2021
@mtrezza mtrezza added the type:meta Non-code issue label Mar 21, 2021
@mtrezza mtrezza unpinned this issue May 2, 2021
@TomWFox TomWFox closed this as completed Jul 15, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
type:meta Non-code issue
Projects
None yet
Development

No branches or pull requests

2 participants