Parse-server is ignoring config vars enableAnonymousUsers and allowClientClassCreation

[grupster]

Make sure these boxes are checked before submitting your issue -- thanks for reporting issues back to Parse Server!

-[x] You've met the prerequisites.

-[x] You're running the latest version of Parse Server.

-[x] You've searched through existing issues. Chances are that your issue has been reported or resolved before.

Environment Setup

Heroku one-clik deploy

Steps to reproduce

1. I create two config env vars in heroku:
   ANON_USERS = false
   CLIENT_CLASS_CREATION = false

2. I clone the app via git (with heroku cli already installed) and added these two new values to the options hash:
   var api = new ParseServer({
   databaseURI: databaseUri || 'mongodb://localhost:27017/dev',
   cloud: process.env.CLOUD_CODE_MAIN || __dirname + '/cloud/main.js',
   appId: process.env.APP_ID || 'myAppId',
   masterKey: process.env.MASTER_KEY || '', //Add your master key here. Keep it secret!
   serverURL: process.env.SERVER_URL || 'http://localhost:1337', // Don't forget to change to https if needed
   enableAnonymousUsers: process.env.ANON_USERS || false,
   allowClientClassCreation: process.env.CLIENT_CLASS_CREATION || false
   });

3. Commit and push. No errors server is running fine.

4. Use the JS SDK (latest version) to post to a new class, user not logged in. The class and document are created on mLab despite both config options being correctly set to FALSE:

   testParse: function() {
   var obj = new Parse.Object('testclass');
   obj.set('key','test');
   obj.save().then(function(obj) {
   console.log(obj.toJSON());
   var query = new Parse.Query('testclass');
   query.get(obj.id).then(function(objAgain) {
   console.log(objAgain.toJSON());
   }, function(err) {console.log(err); });
   }, function(err) { console.log(err); });
   }

Is this an app cache issue?

[gfosco]

Two things here. One, anonymous users being set to false does not stop object creation by non-users. It only stops the ability to create a _User with the anonymous provider.

For the second issue, you need to make sure that not only does the class/collection not exist, but it also doesn't exist as a row in the _SCHEMA collection. I'm guess this could be the reason why it succeeded, that you ran this multiple times and only deleted the collection in-between runs. Can you try again after ensuring the _SCHEMA entry and collection do not exist, and that the server is definitely restarted after?

[grupster]

For #1: how does one prevent non-auth users from CRUD operations then?
For #2: After deploy to Heroku the server does restart (I can see it in the logs) and then I tested for new class names, it was not that I deleted the collection and rerun the JS code with the same class name. So there is no chance a class name was on the schema.

[flovilmart]

@grupster

you need to create a role, like 'authenticatedUser', and add your users to that role.
Then, either set ACL or class level permissions to enforce that option.

For 2, I'm not sure what the problem is

[ChrisGrant]

@grupster did you make any progress on number 2? I'm seeing the same issue on my server too. (Using 2.1.6 on Heroku but with the REST SDK rather than the JavaScript SDK like you)

[flovilmart]

@grupster @ChrisGrant does it still occur on 2.2.4?

[ChrisGrant]

@flovilmart Doesn't look like it. I'm running 2.2.6 and just tested creating a new class from the REST SDK. This was the response:

{"code":119,"error":"This user is not allowed to access non-existent class: TestClass"}

[flovilmart]

So that's good no? Closing now. Feel free to reopen if you encounter the problem again.

[ChrisGrant]

@flovilmart Yeah working as expected. Thanks for your help.

[borhanreo]

i faced the same problem "code": 119, "error": "This user is not allowed to access non-existent class: testClass"

[arthursalgado]

Me too... Someone know how to fix that ? Because even if I create the Class on parse does not create any row on my TestTable.

[ctrongminh]

@arthursalgado: when you create a class using parse-dashboard, it will not automatically add the object compared to rest api or sdk.

I think you can fix the error by either:

1. specify the master key when creating the class
2. remove the option allowClientClassCreation when starting the parse-server

If not, anonymous user cannot create a new class.

[Nisthar]

@grupster did you fixed it ? I am having the same issue here #4527