The option "masterKeyIps" cannot be disabled

[alljinx]

New Issue Checklist

• I am not disclosing a vulnerability.
• I am not just asking a question.
• I have searched through existing issues.
• I can reproduce the issue with the latest version of Parse Server.

Issue Description

Parse-server 6.0.0 allow to restrict IPs than can use the MasterKey using the option "masterKeyIps".
The documentation says "Setting ['0.0.0.0/0'] means disabling the filter and the master key can be used from any IP address".
In fact, even localhost is blocked.

Steps to reproduce

Juste install and configure Parse-Server v6 with the last Parse-Dashboard on your local machine.
Try to launch without the "masterKeyIps" option. Parse dashboard should works well.
Try with masterKeyIps: ['0.0.0.0/0'], after login, Parse Dashboard should display "Server not reachable: unauthorized: master key is required" and the node console should display "error: Request using master key rejected as the request IP address '::1' is not set in Parse Server option 'masterKeyIps'."

Actual Outcome

MasterKey is not usable anywhere with masterKeyIps: ['0.0.0.0/0']

Expected Outcome

MasterKey should be usable everywhere with masterKeyIps: ['0.0.0.0/0']

Environment

parse-server 6.0.0
parse-dashboard 5.0.0

Server

• Parse Server version: 6.0.0
• Operating system: Windows 10
• Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Local

Database

• System (MongoDB or Postgres): Postgres
• Database version: 15
• Local or remote host (MongoDB Atlas, mLab, AWS, Azure, Google Cloud, etc): Local

Client

• SDK (iOS, Android, JavaScript, PHP, Unity, etc): JS
• SDK version: 4.0.0

Logs

error: Request using master key rejected as the request IP address '::1' is not set in Parse Server option 'masterKeyIps'.
Error: unauthorized: master key is required
at handler (C:\GitProjects\jdm\node_modules\parse-server\src\middlewares.js:459:19)
at C:\GitProjects\jdm\node_modules\parse-server\src\PromiseRouter.js:72:20
at processTicksAndRejections (node:internal/process/task_queues:95:5)

[parse-github-assistant]

Thanks for opening this issue!

• 🚀 You can help us to fix this issue faster by opening a pull request with a failing test. See our Contribution Guide for how to make a pull request, or read our New Contributor's Guide if this is your first time contributing.

[mtrezza]

I guess you'd need to specify IPv6 ranges separately. Could you try to set masterKeyIps: ['::/0']? In theory you should be able to set masterKeyIps: ['0.0.0.0/0', '::/0'], but I'm not sure the features supports a mix of IPv4 and IPv6.

[mtrezza]

@alljinx Were you able to resolve this issue?

[alljinx]

Oh sorry, forgot this topic. I was able to make it work using masterKeyIps: ['0.0.0.0/0', '::1']. So there is no bug and I can indeed close this issue. Maybe we should just update the documentation to add the IPv6. Thx !

[mtrezza]

Thanks for reporting back. I reopened to find out where this is actually a bug or only a docs issue.

There should be 2 working solutions for the issue you described:

• a) ['::1'] which is the IPv6 notation for localhost
• b) ['::/0'] which allows any IPv6 address.
• c) ['::'] which allows any IPv6 address, just a different notation from (b) with range omitted.

It seems you already verified that (a) works. Could you also verify (b), (c)?

[chillaxdev]

@mtrezza My original error was '::ffff:192.168.0.156' is not set in Parse Server option...

I was hosting the parse server on a LAN.

Adding masterKeyIps: ['::/0'] did not work for me.
Adding masterKeyIps: ['0.0.0.0/0'] fixed it.

[mtrezza]

Thanks, that's strange. It reports an IPv6 address to not be allow-listed, but then it required an IPv4 CIDR range to allow-list it.

If you don't mind trying it out:

• Does masterKeyIps: ['::'] work?
• Does masterKeyIps: ['::ffff:192.168.0.156'] work, or whatever is the IPv6 address that is logged in the server logs?

[chillaxdev]

'::' does not work.
'::ffff:192.168.0.156' works.

Also, this is my serverURL: http://192.168.0.156:1337/parse

Server is running on Windows 10 x86_64 Pro.

For testing the API, I used the postman client locally to send a request with X-Parse-Master-Key set in the header.

[mtrezza]

I'll leave this issue open as there seems to be a bug in the parsing of IP addresses in masterKeyIps.

[VKlapan]

Hi!

I try to use parse-server 6.0.0 in docker, but have the same problem:
Request using master key rejected as the request IP address '172.21.0.1' is not set in Parse Server option 'masterKeyIps'

which I can't resolve by adding maintenanceKeyIps: ['172.21.0.1'] to config.

Any other ideas?

[mtrezza]

@VKlapan masterKey and maintenanceKey are not the same.