Skip to content

Parse Server option emailVerifyTokenReuseIfValid: true generates new token on every email verification request #8886

Closed
@mtrezza

Description

@mtrezza

New Issue Checklist

Issue Description

The Parse Server option emailVerifyTokenReuseIfValid: true generates a new token on every email verification request. This bug was likely introduced with #8212 where using the masterKey does not provide read access to fields of internal scope, in this case _email_verify_token, _email_verify_token_expires_at.

The bug has not been noticed due to a weak test case which compares the previous to the new token, but does not check whether a token and expiry date is defined at all; since these fields are not returned anymore by the masterKey, the test is comparing undefined values and passes, even if these values have changed in the DB.

// verify that our token & expiration has been changed for this new request
expect(typeof userAfterRequest).toBe('object');
expect(userBeforeRequest._email_verify_token).toEqual(userAfterRequest._email_verify_token);
expect(userBeforeRequest._email_verify_token_expires_at).toEqual(
userAfterRequest._email_verify_token_expires_at
);

Steps to reproduce

See failing test in #8885.

Actual Outcome

Token and expiry date are modified.

Expected Outcome

Token and expiry date are not modified.

Environment

Server

  • Parse Server version: 7.0.0-alpha.5

Metadata

Metadata

Assignees

No one assigned

    Labels

    state:releasedReleased as stable versionstate:released-alphaReleased as alpha versionstate:released-betaReleased as beta versiontype:bugImpaired feature or lacking behavior that is likely assumed

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions