{"action":"created","issue":{"url":"https://api.github.com/repos/parse-community/parse-server/issues/4799","repository_url":"https://api.github.com/repos/parse-community/parse-server","labels_url":"https://api.github.com/repos/parse-community/parse-server/issues/4799/labels{/name}","comments_url":"https://api.github.com/repos/parse-community/parse-server/issues/4799/comments","events_url":"https://api.github.com/repos/parse-community/parse-server/issues/4799/events","html_url":"https://github.com/parse-community/parse-server/issues/4799","id":328159949,"node_id":"MDU6SXNzdWUzMjgxNTk5NDk=","number":4799,"title":"Handling errors with “Session token is expired.” for automatic (anonymous) users","user":{"login":"AlexGingell","id":30291278,"node_id":"MDQ6VXNlcjMwMjkxMjc4","avatar_url":"https://avatars0.githubusercontent.com/u/30291278?v=4","gravatar_id":"","url":"https://api.github.com/users/AlexGingell","html_url":"https://github.com/AlexGingell","followers_url":"https://api.github.com/users/AlexGingell/followers","following_url":"https://api.github.com/users/AlexGingell/following{/other_user}","gists_url":"https://api.github.com/users/AlexGingell/gists{/gist_id}","starred_url":"https://api.github.com/users/AlexGingell/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/AlexGingell/subscriptions","organizations_url":"https://api.github.com/users/AlexGingell/orgs","repos_url":"https://api.github.com/users/AlexGingell/repos","events_url":"https://api.github.com/users/AlexGingell/events{/privacy}","received_events_url":"https://api.github.com/users/AlexGingell/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":8,"created_at":"2018-05-31T14:22:55Z","updated_at":"2018-05-31T17:22:38Z","closed_at":null,"author_association":"NONE","body":"### Issue Description\r\n\r\nMy iOS app uses Parse Server's automatic user feature, namely users do not have to provide login credentials, but instead are logged in automatically and anonymously. These are not users that have been migrated from Parse.com, but automatic users with revocable sessions generated by hosted Parse Server.\r\n\r\nOur client-side Parse initialisation looks like this:\r\n```\r\n[Parse initializeWithConfiguration:[ParseClientConfiguration configurationWithBlock:^(id<ParseMutableClientConfiguration> _Nonnull configuration) { \r\n    configuration.applicationId = <our app id>; \r\n    configuration.clientKey = <our client key>; \r\n    configuration.server = <our server>; }]];\r\n\r\n// Users \r\n[PFUser enableRevocableSessionInBackground]; \r\n[PFUser enableAutomaticUser];\r\n[PFACL setDefaultACL:[PFACL ACL] withAccessForCurrentUser:YES];\r\n```\r\nOn the server, \"Expire inactive session\" is YES, and \"Revoke session on password reset\" is YES. Session length is 1 year in seconds. I do not fully understand what constitutes an \"inactive\" session as far as \"Expire inactive session\" goes, and exactly what \"Expire\" constitutes - deletion from the database, or just making the token invalid. It seems to me that the session remains valid simply for \"session length\" after its inception, regardless of other factors.\r\n\r\nBased on that understanding, everything works as expected - the user can communicate with the database - and at the 1 year mark, the session token appears to expire naturally.\r\n\r\nWith a standard login flow, one would clearly then display a screen allowing the user to login and refresh their token. However, in the case of automatic or anonymous users, that makes no sense - they never entered any login credentials, and so they have no means of refreshing their credentials manually.\r\n\r\nGiven that automatic user is enabled, I would have expected that Parse Server would automatically generate a new session token for a user with anonymous credentials. Instead, any interaction with the server or database fails with:\r\n\r\n`Error Domain=Parse Code=209 \"Session token is expired.\" UserInfo={code=209, temporary=0, error=Session token is expired., NSLocalizedDescription=Session token is expired.}`\r\n\r\nI note that in Parse Server's authentication tab \"App authentication settings\", that \"Enable Anonymous Authentication\" is actually set to NO. My understanding here is that this would simply let users communicate with Parse server without a valid session token or valid PFUser object.  This is not really what we want - we want a valid anonymous PFUser to communicate, as we may later want to transition then to a regular PFUser.  I've tried switching it to YES, but we still see the same errors.\r\n\r\nI am using Parse Server v2.3.2 with MongoDB v3.0.12, and iOS Parse SDK v1.17.1. I am looking to upgrade to the latest versions, but I want to take the time to understand what the problem is first, and if/how this may solve the problem.\r\n\r\nIs this a known bug, solved by a later version or not? Is this a problem with my implementation or understanding?  Can anyone help me with a solution?\r\n\r\nDeleting the app and reinstalling it fixes the problem, because a new automatic user is generated and a fresh session token is provided. In the database this appears as a completely new user and the old one sits unused forevermore.\r\n\r\nI would like to implement a solution that simply grants a new session token for anonymous users with an expired token. It seems as though I must set a finite session length, and I would rather not just set it to 100 years - it does not solve the problem for existing users and feels like a hack.\r\n\r\nThank you for your help.\r\n\r\nKind regards, \r\nAlex\r\n\r\n### Steps to reproduce\r\n\r\nOn the client, initialise Parse with:\r\n```\r\n[Parse initializeWithConfiguration:[ParseClientConfiguration configurationWithBlock:^(id<ParseMutableClientConfiguration> _Nonnull configuration) { \r\n    configuration.applicationId = <app id>; \r\n    configuration.clientKey = <client key>; \r\n    configuration.server = <server>; }]];\r\n\r\n// Users \r\n[PFUser enableRevocableSessionInBackground]; \r\n[PFUser enableAutomaticUser];\r\n[PFACL setDefaultACL:[PFACL ACL] withAccessForCurrentUser:YES];\r\n```\r\n\r\nOn the server use:\r\n```\r\nExpire inactive session: YES\r\nRevoke session on password reset: YES\r\nSession Length: <Finite Time>\r\nEnable Anonymous Authentication: NO or YES...\r\n```\r\n\r\nAnonymous automatic users are created for new users. They work as expected during their valid lifetime. After an automatic PFUser has existed for \"Session Length\" the session token expires.\r\n\r\n#### Expected Results\r\n\r\nGiven that the user did not enter any credentials and that automatic user is enabled, I would have expected Parse Server to grant a new valid (revocable) session token automatically.\r\n\r\n#### Actual Outcome\r\n\r\nClient-server interactions fail with error code 209: \"Session token is expired.\", 101, or 206. 101 is clearly related to the invalid Session Token. 206 may or may not be a related issue.\r\n \r\nThe client is effectively cut adrift from our back-end and cannot synchronise with our database or interact with our server.\r\n\r\nThey cannot be asked to log in, as they have no credentials with which to log in. Currently it seems they are forced to reinstall the app and become a new anonymous user.\r\n\r\n### Environment Setup\r\n\r\n- **Server**\r\n  - parse-server version (Be specific! Don't say 'latest'.) : 2.3.2\r\n  - Operating System:     UNodechef Hostedknown\r\n  - Hardware:             Nodechef Hosted\r\n  - Localhost or remote server? (AWS, Heroku, Azure, Digital Ocean, etc): Remote Nodechef\r\n\r\n- **Database**\r\n  - MongoDB version: 3.0.12\r\n  - Storage engine:  Nodechef Hosted\r\n  - Hardware:        Nodechef Hosted\r\n  - Localhost or remote server? (AWS, mLab, ObjectRocket, Digital Ocean, etc): Remote Nodechef\r\n\r\n### Logs/Trace\r\n\r\n**Initialisation**\r\n\r\n--- Configure Facebook Authentication -- \r\n--- Enable Anonymous Authentication -- \r\n--- Allow Client Class Creation Disabled --- \r\n--- Expire Inactive Sessions Enabled --- \r\n--- Revoke Session On Password Reset Enabled --- \r\n--- Session length in seconds: 31536000 --- \r\n\r\n**Example 209**\r\nSession token is expired. \r\n\r\n**Example 206**\r\n\r\nError generating response. ParseError\r\n{\r\n  \"code\": 206,\r\n  \"message\": \"Cannot modify user k6uCHupaxA.\"\r\n}\r\n\r\nCannot modify user k6uCHupaxA.\r\n\r\n**Example 101**\r\n\r\nError handling request: ParseError\r\n{\r\n  \"code\": 101,\r\n  \"message\": \"invalid session\"\r\n}\r\n\r\ninvalid session \r\n"},"comment":{"url":"https://api.github.com/repos/parse-community/parse-server/issues/comments/393608549","html_url":"https://github.com/parse-community/parse-server/issues/4799#issuecomment-393608549","issue_url":"https://api.github.com/repos/parse-community/parse-server/issues/4799","id":393608549,"node_id":"MDEyOklzc3VlQ29tbWVudDM5MzYwODU0OQ==","user":{"login":"flovilmart","id":364568,"node_id":"MDQ6VXNlcjM2NDU2OA==","avatar_url":"https://avatars3.githubusercontent.com/u/364568?v=4","gravatar_id":"","url":"https://api.github.com/users/flovilmart","html_url":"https://github.com/flovilmart","followers_url":"https://api.github.com/users/flovilmart/followers","following_url":"https://api.github.com/users/flovilmart/following{/other_user}","gists_url":"https://api.github.com/users/flovilmart/gists{/gist_id}","starred_url":"https://api.github.com/users/flovilmart/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flovilmart/subscriptions","organizations_url":"https://api.github.com/users/flovilmart/orgs","repos_url":"https://api.github.com/users/flovilmart/repos","events_url":"https://api.github.com/users/flovilmart/events{/privacy}","received_events_url":"https://api.github.com/users/flovilmart/received_events","type":"User","site_admin":false},"created_at":"2018-05-31T17:22:38Z","updated_at":"2018-05-31T17:22:38Z","author_association":"MEMBER","body":"I would recommend to stick to the latest version as we provide bug fixes only for the latest versions. Also, it is known that nodechef runs a fork of parse-server so I can’t speak to the compatibility with the open source project.\r\n\r\nNode 6 is retired and not supported anymore, the LTS version is 8.10. You should update it as well (or let nodechef know that it’s oudated)"}}
{"actor":{"display_login":"flovilmart"}}