LoginSign Up
← Back to all sparks
P

Parse Server

INFRA · APIS
Velocity5.0

Open-source backend platform for mobile and web apps

parseplatform.org ↗

Parse Server's alphas close an account-takeover bug and open 9.12 with Keycloak audience checks.

securityauthenticationbackend as a serviceopen sourcenode.js
◆Current state
Parse Server spent November 4 to 10 on 9.11.1 security alphas. The latest close a bug where changing another user's password returned that user's session token, a Google Play Games adapter that accepted foreign player IDs, and a default upload filter that let RSS and Atom files through. 9.12.0 opened on November 10 with a Keycloak audience check, and alpha.2 fixes a LiveQuery event-loop block.
◆Where it's heading
Most releases are security fixes, many tied to published GHSA advisories, and they cluster around auth adapters, triggers and query limits. The new features also tighten auth, so the project is hardening its identity surface more than adding capability.
◆Prediction
Expect more auth-adapter and LiveQuery advisories in the 9.12 alphas before a stable cut bundles them.

◆Recent moves

  1. 3d ago

    Parse Server fixes a LiveQuery event-loop block

    A LiveQuery subscription with a large list constraint could block the event loop, a denial-of-service advisory. The second 9.12 alpha is again a security fix.

    View source ↗
  2. 3d ago

    Parse Server 9.12 alpha adds Keycloak audience validation

    The Keycloak adapter can now check a token's audience, so tokens issued for another app are rejected. The 9.12 line opens with an auth tightening, not a feature.

    View source ↗
  3. 3d ago

    Parse Server blocks RSS and Atom uploads by default

    The default file-extension filter now blocks RSS and Atom files, which could be used to serve scripted content. A safer default for file uploads.

    View source ↗
  4. 3d ago

    Parse Server stops password changes leaking session tokens

    Changing another user's password returned that user's session token, which let an admin-level caller act as them. The most serious fix in the 9.11.1 run.

    View source ↗
  5. 4d ago

    Parse Server checks Google Play Games player IDs

    The Google Play Games adapter accepted a player ID the token did not belong to, an advisory that allowed signing in as another player. Another auth adapter fix.

    View source ↗
  6. 8d ago

    Parse Server closes a nested $regex gap in query limits

    The allowRegex option now rejects $regex hidden inside other query operators, closing a way around the limit. It is the third 9.11.1 alpha fix in three days, all tightening the query and write paths.

    View source ↗