fix: Disallow header aliases for master and maintenance keys

Prevent credential-bearing Parse headers from being aliased so secrets cannot be smuggled under alternate names.

Author: Moumouls

spec/HeaderAliasesValidation.spec.js

@@ -143,6 +143,19 @@ describe('Config.validateHeaderAliases', () => {
     ).toThrowError(/is not an allowed Parse header/);
   });
 
+  it('should reject credential-bearing master and maintenance key aliases', () => {
+    expect(() =>
+      Config.validateHeaderAliases({
+        'X-Parse-Master-Key': ['X-Master-Key-Alias'],
+      })
+    ).toThrowError(/is not an allowed Parse header/);
+    expect(() =>
+      Config.validateHeaderAliases({
+        'X-Parse-Maintenance-Key': ['X-Maintenance-Key-Alias'],
+      })
+    ).toThrowError(/is not an allowed Parse header/);
+  });
+
   it('should reject an alias that normalizes to the same value as its canonical header', () => {
     expect(() =>
       Config.validateHeaderAliases({

spec/Middlewares.spec.js

@@ -573,7 +573,21 @@ describe('middlewares', () => {
     ).toThrowError(/contains invalid characters/);
   });
 
-  it('should resolve master key from configured alias in handleParseAuth', async () => {
+  it('should reject privileged master and maintenance key aliases at validation time', () => {
+    const Config = require('../lib/Config');
+    expect(() =>
+      Config.validateHeaderAliases({
+        'X-Parse-Master-Key': ['X-Master-Key-Alias'],
+      })
+    ).toThrowError(/is not an allowed Parse header/);
+    expect(() =>
+      Config.validateHeaderAliases({
+        'X-Parse-Maintenance-Key': ['X-Maintenance-Key-Alias'],
+      })
+    ).toThrowError(/is not an allowed Parse header/);
+  });
+
+  it('should not rewrite master-key aliases when present in request headers', done => {
     AppCachePut(fakeReq.body._ApplicationId, {
       headerAliases: {
         'X-Parse-Master-Key': ['X-Master-Key-Alias'],
@@ -582,13 +596,10 @@ describe('middlewares', () => {
       masterKeyIps: ['0.0.0.0/0'],
     });
     fakeReq.headers['x-master-key-alias'] = 'masterKey';
-    await new Promise(resolve =>
-      middlewares.handleHeaderAliases(fakeReq.body._ApplicationId)(fakeReq, fakeRes, resolve)
-    );
-    await new Promise(resolve =>
-      middlewares.handleParseAuth(fakeReq.body._ApplicationId)(fakeReq, fakeRes, resolve)
-    );
-    expect(fakeReq.auth.isMaster).toBe(true);
+    middlewares.handleHeaderAliases(fakeReq.body._ApplicationId)(fakeReq, fakeRes, () => {
+      expect(fakeReq.headers['x-parse-master-key']).toBeUndefined();
+      done();
+    });
   });
 
   it('should call next without throwing when app is not in AppCache', () => {

spec/ParseGraphQLServer.spec.js

@@ -127,6 +127,11 @@ describe('ParseGraphQLServer', () => {
       });
       expect(headers).toEqual(['X-Parse-Application-Id', 'X-Safe-Custom']);
     });
+
+    it('should tolerate null or undefined headerAliases without throwing', () => {
+      expect(getCSRFRequestHeaders(null)).toEqual(['X-Parse-Application-Id']);
+      expect(getCSRFRequestHeaders(undefined)).toEqual(['X-Parse-Application-Id']);
+    });
   });
 
   describe('_getServer', () => {

spec/rest.spec.js

@@ -1739,6 +1739,20 @@ describe('read-only masterKey', () => {
 });
 
 describe('rest header aliases', () => {
+  const signUpViaRest = async username => {
+    const response = await request({
+      url: `${Parse.serverURL}/users`,
+      method: 'POST',
+      headers: {
+        'X-Parse-Application-Id': Parse.applicationId,
+        'X-Parse-REST-API-Key': 'rest',
+        'Content-Type': 'application/json',
+      },
+      body: { username, password: 'password' },
+    });
+    return response.data;
+  };
+
   it('supports REST requests with application-id header alias only', async () => {
     await reconfigureServer({
       headerAliases: {
@@ -1793,19 +1807,20 @@ describe('rest header aliases', () => {
       },
     });
     try {
-      const canonicalUser = await Parse.User.signUp(`alias-rest-canonical-${Date.now()}`, 'password');
-      const aliasUser = await Parse.User.signUp(`alias-rest-alias-${Date.now()}`, 'password');
+      // Create users via REST so the SDK current-user singleton is not shared/overwritten.
+      const canonicalUser = await signUpViaRest(`alias-rest-canonical-${Date.now()}`);
+      const aliasUser = await signUpViaRest(`alias-rest-alias-${Date.now()}`);
       const response = await request({
         url: `${Parse.serverURL}/users/me`,
         method: 'GET',
         headers: {
           'X-Parse-Application-Id': Parse.applicationId,
           'X-Parse-REST-API-Key': 'rest',
-          'X-Parse-Session-Token': canonicalUser.getSessionToken(),
-          'X-Session-Token-Alias': aliasUser.getSessionToken(),
+          'X-Parse-Session-Token': canonicalUser.sessionToken,
+          'X-Session-Token-Alias': aliasUser.sessionToken,
         },
       });
-      expect(response.data.objectId).toBe(canonicalUser.id);
+      expect(response.data.objectId).toBe(canonicalUser.objectId);
     } finally {
       await reconfigureServer();
     }
@@ -1818,19 +1833,20 @@ describe('rest header aliases', () => {
       },
     });
     try {
-      const firstAliasUser = await Parse.User.signUp(`alias-rest-a-${Date.now()}`, 'password');
-      const secondAliasUser = await Parse.User.signUp(`alias-rest-b-${Date.now()}`, 'password');
+      // Create users via REST so the SDK current-user singleton is not shared/overwritten.
+      const firstAliasUser = await signUpViaRest(`alias-rest-a-${Date.now()}`);
+      const secondAliasUser = await signUpViaRest(`alias-rest-b-${Date.now()}`);
       const response = await request({
         url: `${Parse.serverURL}/users/me`,
         method: 'GET',
         headers: {
           'X-Parse-Application-Id': Parse.applicationId,
           'X-Parse-REST-API-Key': 'rest',
-          'X-Session-Token-Alias-B': secondAliasUser.getSessionToken(),
-          'X-Session-Token-Alias-A': firstAliasUser.getSessionToken(),
+          'X-Session-Token-Alias-B': secondAliasUser.sessionToken,
+          'X-Session-Token-Alias-A': firstAliasUser.sessionToken,
         },
       });
-      expect(response.data.objectId).toBe(firstAliasUser.id);
+      expect(response.data.objectId).toBe(firstAliasUser.objectId);
     } finally {
       await reconfigureServer();
     }

src/Config.js

@@ -43,7 +43,20 @@ function removeTrailingSlash(str) {
  */
 const asyncKeys = ['publicServerURL'];
 
+// Canonical Parse headers that may be aliased. Credential-bearing headers
+// (master key, maintenance key) are intentionally excluded.
+const ALLOWED_HEADER_ALIAS_CANONICALS = new Set([
+  'x-parse-application-id',
+  'x-parse-session-token',
+  'x-parse-installation-id',
+  'x-parse-client-key',
+  'x-parse-javascript-key',
+  'x-parse-windows-key',
+  'x-parse-rest-api-key',
+]);
+
 export class Config {
+  static ALLOWED_HEADER_ALIAS_CANONICALS = ALLOWED_HEADER_ALIAS_CANONICALS;
   static get(applicationId: string, mount: string) {
     const cacheInfo = AppCache.get(applicationId);
     if (!cacheInfo) {
@@ -777,17 +790,6 @@ export class Config {
         throw 'Header aliases must be an object';
       }
       const SAFE_HEADER_NAME = /^[A-Za-z0-9-]+$/;
-      const ALLOWED_CANONICAL_HEADERS = new Set([
-        'x-parse-application-id',
-        'x-parse-session-token',
-        'x-parse-master-key',
-        'x-parse-maintenance-key',
-        'x-parse-installation-id',
-        'x-parse-client-key',
-        'x-parse-javascript-key',
-        'x-parse-windows-key',
-        'x-parse-rest-api-key',
-      ]);
       const entries = Object.entries(headerAliases);
       for (const [canonicalHeader, aliases] of entries) {
         if (typeof canonicalHeader !== 'string' || !canonicalHeader.trim().length) {
@@ -799,7 +801,7 @@ export class Config {
             `Header aliases canonical '${canonicalHeader}' contains invalid characters`
           );
         }
-        if (!ALLOWED_CANONICAL_HEADERS.has(trimmedCanonical.toLowerCase())) {
+        if (!Config.ALLOWED_HEADER_ALIAS_CANONICALS.has(trimmedCanonical.toLowerCase())) {
           throw new Error(
             `Header aliases canonical '${canonicalHeader}' is not an allowed Parse header`
           );

src/Options/Definitions.js

@@ -318,7 +318,7 @@ module.exports.ParseServerOptions = {
   },
   headerAliases: {
     env: 'PARSE_SERVER_HEADER_ALIASES',
-    help: '(Optional) Define aliases for Parse request headers. For each canonical Parse header, set an array of accepted alias headers. If the canonical header is not present in a request, Parse Server uses the first matching alias.<br><br>Example:<br>`{ "X-Parse-Application-Id": ["X-App-Id"], "X-Parse-Session-Token": ["X-Session-Token"] }`<br><br>When setting this option via an environment variable, provide a JSON object string.',
+    help: '(Optional) Define aliases for Parse request headers. For each allowed canonical Parse header, set an array of accepted alias headers. Aliases are only supported for non-secret headers (application ID, session token, installation ID, and client/API keys). Credential-bearing headers such as X-Parse-Master-Key and X-Parse-Maintenance-Key cannot be aliased. If the canonical header is not present in a request, Parse Server uses the first matching alias.<br><br>Example:<br>`{ "X-Parse-Application-Id": ["X-App-Id"], "X-Parse-Session-Token": ["X-Session-Token"] }`<br><br>When setting this option via an environment variable, provide a JSON object string.',
     action: parsers.objectParser,
   },
   host: {

src/Options/docs.js

@@ -91,7 +91,7 @@ export interface ParseServerOptions {
   appName: ?string;
   /* Add headers to Access-Control-Allow-Headers */
   allowHeaders: ?(string[]);
-  /* (Optional) Define aliases for Parse request headers. For each canonical Parse header, set an array of accepted alias headers. If the canonical header is not present in a request, Parse Server uses the first matching alias.<br><br>Example:<br>`{ "X-Parse-Application-Id": ["X-App-Id"], "X-Parse-Session-Token": ["X-Session-Token"] }`<br><br>When setting this option via an environment variable, provide a JSON object string.
+  /* (Optional) Define aliases for Parse request headers. For each allowed canonical Parse header, set an array of accepted alias headers. Aliases are only supported for non-secret headers (application ID, session token, installation ID, and client/API keys). Credential-bearing headers such as X-Parse-Master-Key and X-Parse-Maintenance-Key cannot be aliased. If the canonical header is not present in a request, Parse Server uses the first matching alias.<br><br>Example:<br>`{ "X-Parse-Application-Id": ["X-App-Id"], "X-Parse-Session-Token": ["X-Session-Token"] }`<br><br>When setting this option via an environment variable, provide a JSON object string.
   :ENV: PARSE_SERVER_HEADER_ALIASES */
   headerAliases: ?{ [string]: string[] };
   /* Sets origins for Access-Control-Allow-Origin. This can be a string for a single origin or an array of strings for multiple origins. */

src/Options/index.js

@@ -83,7 +83,7 @@ const mergeHeaders = (...headerSources) => {
 };
 
 export function getHeaderAliases(headerAliases, canonicalHeader) {
-  const aliases = headerAliases[canonicalHeader];
+  const aliases = headerAliases?.[canonicalHeader];
   if (!Array.isArray(aliases)) {
     return [];
   }
@@ -95,6 +95,11 @@ function applyHeaderAliases(req, headerAliases) {
   req.headers = req.headers || {};
   for (const [canonicalHeader, aliases] of Object.entries(headerAliases || {})) {
     const canonicalKey = String(canonicalHeader).trim().toLowerCase();
+    // Only rewrite allowlisted, non-secret Parse headers (one-to-one mapping
+    // and destination allowlist are also enforced in Config.validateHeaderAliases).
+    if (!Config.ALLOWED_HEADER_ALIAS_CANONICALS.has(canonicalKey)) {
+      continue;
+    }
     if (req.headers[canonicalKey] !== undefined) {
       continue; // canonical wins
     }

src/middlewares.js

@@ -52,6 +52,12 @@ export interface ParseServerOptions {
     maintenanceKeyIps?: (string[]);
     appName?: string;
     allowHeaders?: (string[]);
+    /**
+     * Optional aliases for non-secret Parse request headers only
+     * (application ID, session token, installation ID, client/API keys).
+     * Credential-bearing headers such as X-Parse-Master-Key and
+     * X-Parse-Maintenance-Key cannot be aliased and are rejected at validation.
+     */
     headerAliases?: { [headerName: string]: string[] };
     allowOrigin?: StringOrStringArray;
     analyticsAdapter?: Adapter<AnalyticsAdapter>;