10 ms·
Parse is very unsecure because you essentially give the user full read/write/delete access to all of its data as no logic is run server side but clientside. Tha
by TobiHeidi 15y ago
Parse is very unsecure because you essentially give the user full read/write/delete access to all of its data as no logic is run server side but clientside. That means any scriptkiddy can change all data as it likes.
That has nothing to do with MongoDB, but with the cirtical design flaw of Parse to trust the client not to send fake data.
- ZephyrP 15y agoMy initial intuition is that such an egregious oversight can't possibly be real for a YC11 company, can anyone validate this? Does Parse really provide no way to set document fields writable, readable and so on?
- aherlambang 15y agoIn Parse you can authorize/de-authorize client permission to get, find, update, create, and delete for each table
- seivan 15y agoYes that is one way to look at it - but my initial focus was not on the server sided logic, but the persistent store, in this case, MongoDB.