Make passwordPolicy validatorCallback asynchronous
Nobody has claimed this yet.
Assessment
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Newbie friendliness
- 68/100
- Issue type
- Feature
- Clarity
- Clearly specified
- Activity status
- Quiet
- Tech stack
- javascript, typescript
- Domain
- authentication, backend, security
Research direction
Start by reading RestWrite.js and the PasswordPolicyOptions type declaration to trace the validatorCallback invocation and its typing. Verify that synchronous and asynchronous callbacks are both supported and that the declaration accepts Promise; check the related password-policy behavior before considering the work done.
Written by the indexing model from the issue text.
Description
New Feature / Enhancement Checklist
- Report security issues confidentially.
- Any contribution is under this license.
- Before posting search existing issues.
Current Limitation
Custom validation on passwords may include asynchronous operations, such as hitting an special endpoint. The current validator only runs synchronously.
Feature / Enhancement Description
RestWrite.js should wrap the validatorCallback invocation with await Promise.resolve(...) so that both synchronous (boolean) and asynchronous (Promise) callbacks are supported. The type declaration for validatorCallback in PasswordPolicyOptions should be updated accordingly to (password: string) => boolean | Promise<boolean>.
Also worth mentioning the typing issue in https://github.com/parse-community/parse-server/issues/10471
// Before
if (
this.config.passwordPolicy.validatorCallback &&
!this.config.passwordPolicy.validatorCallback(this.data.password)
) { ... }
// After
if (this.config.passwordPolicy.validatorCallback) {
const isValid = await Promise.resolve(
this.config.passwordPolicy.validatorCallback(this.data.password)
);
if (!isValid) {
return Promise.reject(new Parse.Error(Parse.Error.VALIDATION_ERROR, policyError));
}
}
Example Use Case
- Send a login/sign up request with a password
- Expect an asynchronous operation to happen inside the validation
Alternatives / Workarounds
Custom logic in beforePasswordResetRequest, beforeLogin and beforeSave for _User
3rd Party References
- Dominant language
- JavaScript
- Stars
- 21.4k
- Forks
- 4.8k
- Avg merge
- 7h 45m
- Merged PRs (30d)
- 11
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from parse-community/parse-server
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
parse-community/parse-server#10634 · 1 comment ·
-
Difficulty 1/5 Under an hour Newbie friendliness 84/100
parse-community/parse-server#10631 · 1 comment ·
-
/installations and /audiences reject a find sent as POST + _method=GET with "Invalid key name: 0" Open
Difficulty 2/5 Half a day Newbie friendliness 65/100
parse-community/parse-server#10626 · 1 comment ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
parse-community/parse-server#10619 · 1 comment ·
-
type:meta
Difficulty 2/5 1-3 hours Newbie friendliness 68/100
parse-community/parse-server#10613 · 2 comments ·
All issues in parse-community/parse-server
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 88/100
HarperFast/skills#96 ·
-
[Block] Latest Posts [Type] Bug
Difficulty 2/5 1-3 hours Newbie friendliness 76/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 78/100
Automattic/studio#4908 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 74/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 86/100
sugarlabs/musicblocks#8847 ·