title: Parse Database Authorization - Security For User Objects
body: <p>I have an ASP.NET MVC 4 web application where i use Parse as database in the back-end (<a href="https://www.parse.com/" rel="nofollow">https://www.parse.com/</a>) and C# as programming language.</p>
  
  <p>I use ParseUser class to log in registered users (<a href="https://www.parse.com/docs/dotnet_guide#users-login" rel="nofollow">https://www.parse.com/docs/dotnet_guide#users-login</a>) like this:</p>
  
  <pre><code>ParseUser.LogInAsync("my_username", "my_password");
  </code></pre>
  
  <p>Then i have created a custom authorization attribute and i apply it in some controllers and action methods of my project.</p>
  
  <pre><code>public class AuthorizeParseUserAttribute : AuthorizeAttribute
  {
      protected override bool AuthorizeCore(HttpContextBase httpContext)
      {
          if (ParseUser.CurrentUser != null &amp;&amp; ParseUser.CurrentUser.IsAuthenticated)
          {
              return true;
          }
  
          return false;
      }
  }
  </code></pre>
  
  <p>This is Parse's documentation for CurrentUser property <a href="https://www.parse.com/docs/dotnet_guide#users-current" rel="nofollow">https://www.parse.com/docs/dotnet_guide#users-current</a> </p>
  
  <p><strong>So, I have the following problem:</strong> I successfully log in using my credentials. After log in, i enter the main page of my application (the AuthorizeParseUserAttribute has been applied to the corresponding action method). Then i send the url of this main page to another person, in another computer and the user (which is not even a registered user) can see the main page of my application and is logged in with my credentials!!! Parse's documentation for security for user objects is the following <a href="https://www.parse.com/docs/dotnet_guide#users-security" rel="nofollow">https://www.parse.com/docs/dotnet_guide#users-security</a></p>
  
  <p>Can you please propose any solution to solve this very serious problem? Thank you.</p>