parse-server 2.8.1: Cannot login after changing user password

[nebitrams]

Issue Description

These is error deployment error (see log showing Kerberos compilation error) when I deploy to Heroku. The application works fine in all expects except that I cannot login after changing user password.

Steps to reproduce

1. Change user password using iOS ParseUI and also parse dashboard.
2. Login using App ParseUI Login screen.
3. Failed to login and this is the server error log.

error: Error generating response. ParseError { code: 101, message: 'Invalid username/password.' } code=101, message=Invalid username/password.
error: Invalid username/password. code=101, message=Invalid username/password.

It works after I rollback to previous version in heroku with parse-server 2.7.4

Expected Results

I should be able to login after changing password.

Actual Outcome

I cannot login.

Environment Setup

• Server

  • parse-server version (Be specific! Don't say 'latest'.) : 2.8.1
  • Operating System: Heroku stack Cedar-14
  • Hardware: Heroku
  • Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): Heroku

• Database

  • MongoDB version: current is 3.2.10 (MMAPv1). Should I switch to mLab latest 3.4.15 (MMAPv1)?
  • Storage engine: mLab
  • Hardware: mLab
  • Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): mLab

Logs/Trace

This is the heroku deployment error.

-----> Node.js app detected
-----> Creating runtime environment

   NPM_CONFIG_LOGLEVEL=error
   NODE_VERBOSE=false
   NODE_ENV=production
   NODE_MODULES_CACHE=true

-----> Installing binaries
engines.node (package.json): >=4.3
engines.npm (package.json): unspecified (use default)

   Resolving node version >=4.3...
   Downloading and installing node 10.2.0...
   Using default npm version: 5.6.0

-----> Restoring cache
Skipping cache restore (new-signature)
-----> Building dependencies
Installing node modules (package.json)

   > parse-image@0.2.0 preinstall /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/parse-image
   > ./install.sh
   
   Cannot install using brew or sudo apt-get
   Please install manually
   
   > bcrypt@2.0.1 install /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/bcrypt
   > node-pre-gyp install --fallback-to-build
   
   [bcrypt] Success: "/tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/bcrypt/lib/binding/bcrypt_lib.node" is installed via remote
   
   > uws@10.148.0 install /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/uws
   > node-gyp rebuild > build_log.txt 2>&1 || exit 0
   
   
   > kerberos@0.0.23 install /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/kerberos
   > (node-gyp rebuild) || (exit 0)
   
   make: Entering directory `/tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/kerberos/build'
   CXX(target) Release/obj.target/kerberos/lib/kerberos.o
   In file included from ../lib/kerberos.h:4:0,
   from ../lib/kerberos.cc:1:
   /app/.node-gyp/10.2.0/include/node/node.h:53:50: fatal error: core.h: No such file or directory
   #include "core.h"  // NOLINT(build/include_order)
   ^
   compilation terminated.
   make: *** [Release/obj.target/kerberos/lib/kerberos.o] Error 1
   make: Leaving directory `/tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/kerberos/build'
   gyp ERR! build error
   gyp ERR! stack Error: `make` failed with exit code: 2
   gyp ERR! stack     at ChildProcess.onExit (/tmp/build_786e8213e834a7d1022250f222c7b1bb/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/lib/build.js:258:23)
   gyp ERR! stack     at ChildProcess.emit (events.js:182:13)
   gyp ERR! stack     at Process.ChildProcess._handle.onexit (internal/child_process.js:237:12)
   gyp ERR! System Linux 4.4.0-1019-aws
   gyp ERR! command "/tmp/build_786e8213e834a7d1022250f222c7b1bb/.heroku/node/bin/node" "/tmp/build_786e8213e834a7d1022250f222c7b1bb/.heroku/node/lib/node_modules/npm/node_modules/node-gyp/bin/node-gyp.js" "rebuild"
   gyp ERR! cwd /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/kerberos
   gyp ERR! node -v v10.2.0
   gyp ERR! node-gyp -v v3.6.2
   gyp ERR! not ok
   
   > parse-server@2.8.1 postinstall /tmp/build_786e8213e834a7d1022250f222c7b1bb/node_modules/parse-server

[flovilmart]

Please provide the logs when running with VERBOSE=1 of the whole process of singing up, logging in, changing password etc...

[flovilmart]

Is the old password still valid?

[nebitrams]

I can't try because I could not remember the old password. I test against several other accounts and it seems that this problem affect accounts that are created long ago such as April 2015 (they were migrated from parse.com to ParseServer). The recent accounts is working fine after password reset.

Is this related to the migration of revokable session token (in 2017) or the User.authData and Session data?

I am going to sleep now and will be back online in 8 hours time. Thanks Mr Vilmart for checking on this.

[flovilmart]

Perhaps those account are still on revocable sessions and you’re hitting a nasty bug. Any chance you can get a look at the object in the DB and check if the sessionToken is still an old one ?

[nebitrams]

I used mLab to query the _Session table. I could not find session for the failed to logon users.

This is the _user record for the account that I could not login. Does it contain any clue on the sessionToken type?
{
"_id": "xxx",
"_created_at": {
"$date": "2015-01-26T00:34:23.529Z"
},
"_hashed_password": "hashedXXX",
"_session_token": "xxx",
"_updated_at": {
"$date": "2018-05-26T15:51:12.611Z"
},
"email": "xxx@a.b",
"username": "Nebi",
"emailVerified": true,
"_email_verify_token": "yyy"
}

[flovilmart]

Legacy session tokens have the token on he user object; this is what you see there.

[nebitrams]

Thanks Florent. Was there any recent deprecation of logic in this area? What are the ways that I can adopt to solve this problem?

[flovilmart]

parse-server never supported old session tokens, further investigation need to be done to reproduce the issue and perhaps find a workaround. I have trouble also understanding why login information would not work after resetting the password.

[nebitrams]

Thanks.

Apparently, for those old user account, session token is never generated for user login. I can help to test/reproduce if you need, just let me know.

May I trouble you to delete the log file that I submitted earlier? I deleted the link in this thread but could not delete the file. I can email you the actual link if you need to link to delete it.

[flovilmart]

I don’t believe I have access to the log file myself. I can see the comment isn’t there anymore.

As for the reproduction, that would be very nice to have an edge to edge test that simulates this password exchange / replacement flow. This may help us understand the issue a bit more in depth.

There are many tests for the ‘reset password’ emails as well as for legacy session tokens. Perhaps there’s something there that’s problematic

[lxknvlk]

I have the same problem, just after updating parse server logging in with my old password returned invalid username/password error. Then i have changed password, logged in. After some time logged out and again i cant login. In all cases the password was the same old password.

[nebitrams]

I work around this problem by manually deleting the old "_User" record and use app GUI to "signup" for new user account.

The new user account is having different data structure and don't have the password reset problem.
{
"_id": "xxx",
"email": "xxx@a.b",
"username": "Nebi",
"_hashed_password": "hashedXXX",
"emailVerified": true,
"_wperm": [
"xxx"
],
"_rperm": [
"",
"xxx"
],
"_acl": {
"xxx": {
"w": true,
"r": true
},
"": {
"r": true
}
},
"_created_at": {
"$date": "20xx-xx-xxTyy:yy:yy.yyyZ"
},
"_updated_at": {
"$date": "20xx-xx-xxTyy:yy:yy.yyyZ"
}
}

[flovilmart]

Interesting! I’ll be able to investigate from there with the old user data then!

[flovilmart]

The full old user object is the one that was previously posted?