awsparse

Force HTTPS for Parse Server requests

When you design your own application and make requests to the Parse API you design, your Application ID will be sent in plaintext in API requests. This is dangerous, since anyone with bad intentions could sniff them and break into the application, or even worse, access confidential data from your clients.

To force HTTPS for all API requests, follow these steps:

  • Edit and modify the /opt/bitnami/apache/conf/parse-vhost.conf file so that it fits with this structure. Remplace the DOMAIN placeholders with the corresponding domain name.

      <VirtualHost *:80>
      ServerName DOMAIN
      ServerAlias www.DOMAIN
      RewriteEngine On
      RewriteCond %{HTTPS} off
      RewriteRule (.*) https://%{SERVER_NAME}$1 [R,L]
  </VirtualHost>

  • Edit and modify the /opt/bitnami/apache/conf/parse-https-vhost* file so that it fits with this structure.

      <VirtualHost *:443>
      ServerName DOMAIN
      ServerAlias www.DOMAIN
      SSLEngine on
      SSLCertificateFile "/opt/bitnami/apache/conf/bitnami/certs/server.crt"
      SSLCertificateKeyFile "/opt/bitnami/apache/conf/bitnami/certs/server.key"
  </VirtualHost>

  • Edit the serverURL variable property from both api and dashboard objects in the script found at /opt/bitnami/apps/parse/htdocs/server.js:

      serverURL: "https://SERVER-IP/parse",

    Please remember to replace the SERVER-IP placeholder with the corresponding public IP or domain name.

  • Restart the servers in the stack:

        $ sudo /opt/bitnami/ctlscript.sh restart

Your application should now force HTTPS for all API requests correctly.

For more information about this process, refer to this section.

Last modification December 21, 2022