Parse : invalid username, password

Question

I was using the Parse API for databases and trying to use the username service that it provides. I understand that from the tutorial that in order to login you do this :

ParseUser.logInInBackground("Jerry", "showmethemoney", new LogInCallback() {
  public void done(ParseUser user, ParseException e) {
    if (user != null) {
      // Hooray! The user is logged in.
    } else {
      // Signup failed. Look at the ParseException to see what happened.
    }
  }
});

If the login failed, I was just wondering how I could tell whether it failed because the username typed in was invalid, or the password. I know that you can do e.getCode() to get the type of error that occurred, but from this site https://parse.com/docs/android/api/ I couldn't find any error codes pertaining to invalid username/password

Thank you james

Answer 1

This is what I did to check username/password validity in one of my applications. This method submits a query against the ParseUser class and returns true if the passed username exists, if it does then you know the username is valid.

(check externally for ParseException.OBJECT_NOT_FOUND - in conjunction with this we can tell whether the user needs to register or has an invalid password.)

public boolean queryCredentials(String username) {
        ParseQuery<ParseUser> queryuserlist = ParseUser.getQuery();
        queryuserlist.whereEqualTo("username", username);
        try {
            //attempt to find a user with the specified credentials.
            return (queryuserlist.count() != 0) ? true : false;
        } catch (ParseException e) {
            return false;
        }
    }

Hopefully this can help someone with this issue.

Answer 2

It seems to be a security risk to distinguish between invalid user and invalid password. This information would let a hacker test account names until the app gave an invalid password response, which would let the hacker know at least the username of a valid user. Therefore, I think Parse makes this difficult deliberately.

However, it may be possible to do this using a query that searches for users with the given username. If the query returns no users, the username is invalid. If the username returns a user, the password is invalid.