Incorrect 500 on /file endpoint when not providing application id

[sunshineo]

Issue Description

Try POST a file to the /file endpoint without providing x-parse-application-id will get a 500 internal server error. Here is the verbose log

error: Uncaught internal server error.Unexpected token � in JSON at position 0 {"stack":"SyntaxError: Unexpected token � in JSON at position 0\n    at JSON.parse (<anonymous>)\n    at handleParseHeaders (/Users/gordon/workspace/pipe17/parse/node_modules/parse-server/lib/middlewares.js:81:23)\n    at Layer.handle [as handle_request] (/Users/gordon/workspace/pipe17/parse/node_modules/express/lib/router/layer.js:95:5)\n    at next (/Users/gordon/workspace/pipe17/parse/node_modules/express/lib/router/route.js:137:13)\n    at /Users/gordon/workspace/pipe17/parse/node_modules/body-parser/lib/read.js:130:5\n    at invokeCallback (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:224:16)\n    at done (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:213:7)\n    at IncomingMessage.onEnd (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:273:7)\n    at IncomingMessage.emit (events.js:228:7)\n    at IncomingMessage.EventEmitter.emit (domain.js:475:20)"}
SyntaxError: Unexpected token � in JSON at position 0
    at JSON.parse (<anonymous>)
    at handleParseHeaders (/Users/gordon/workspace/pipe17/parse/node_modules/parse-server/lib/middlewares.js:81:23)
    at Layer.handle [as handle_request] (/Users/gordon/workspace/pipe17/parse/node_modules/express/lib/router/layer.js:95:5)
    at next (/Users/gordon/workspace/pipe17/parse/node_modules/express/lib/router/route.js:137:13)
    at /Users/gordon/workspace/pipe17/parse/node_modules/body-parser/lib/read.js:130:5
    at invokeCallback (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:224:16)
    at done (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:213:7)
    at IncomingMessage.onEnd (/Users/gordon/workspace/pipe17/parse/node_modules/raw-body/index.js:273:7)
    at IncomingMessage.emit (events.js:228:7)
    at IncomingMessage.EventEmitter.emit (domain.js:475:20)

Steps to reproduce

Setup a Parse server and config it to be able to take file upload. Then make the same file upload request without the x-parse-application-id header and you will get a 500

Expected Results

Should be a 401 or 403 with a message saying that you are missing the header. This cost us several hours to debug. I wish we can remove the application id completely. It provides no value and just causing trouble

Actual Outcome

500 error

Environment Setup

• Server

  • parse-server version 3.10.0
  • Operating System: docker node:lts
  • Hardware: aws ec2
  • Localhost or remote server? aws ec2

• Database

  • MongoDB version: 4.2.5
  • Storage engine: not sure
  • Hardware: not sure
  • Localhost or remote server? hosted by MongoDB Atlas

Logs/Trace

See above

[sunshineo]

Direct cause is here https://github.com/parse-community/parse-server/blob/master/src/middlewares.js#L62 . Trying to JSON parse on binary file

Code is doing this because it did not find x-parse-application-id on the headers and assumes that it will be in a JSON body. The dashboard and maybe the JS sdk calls the server this way

One of the reasons that allows this way of calling the server is to avoid preflight and make it faster discussed in this ticket parse-community/Parse-SDK-JS#630 (comment) .

Premature optimization is the root of all evil

[davimacedo]

Good catch @sunshineo . Would you be willed to send a PR fixing this one?

[sunshineo]

Submitted a PR