Parse Server Session Token Security Issue

If an attacker has access to the JavaScript Key he can do anything your vue app can do. He doesn’t even need the session token.

What you are describing is a Dos attack. A Dos attack is effective only if the attacker can generate high loads on the server without generating high loads on himself. In your case might be able to generate many objects but he won’t be able to overload your server (unless he has more processing power than you).

Additionally, if you just want to keep you db clean you might want to restrict creating users so it is not possible with only the JavaScript key. This way you give access only to users you trust. Problem with that is it doesn’t scale.

This dilemma is not special to Parse Server. Most web applications tackle this by not trusting the client side and limiting his actions to specific tables, exactly like CLP (Class level permissions) in Parse Server.

Disable Create permissions on your tables using CLPs.

https://docs.parseplatform.org/parse-server/guide/#class-level-permissions

With more information, this better solves your needs:

Parse.Cloud.beforeSave('Article', (req, res) => {
    let article = req.object;
    if( object.isNew() ) {
        let query = new Parse.Query('Article');
        let 5MinsAgo = //Calculate date
        query.greaterThan('createdAt', 5MinsAgo).equalTo('Author', article.get('Author');
        return query.count().then(
            count => { 
                if( count > max_allowed_count ) res.error('You've created too many articles.');
                else res.success();
            }
        );
    }
    else res.success(); //Or any other validation
});

You could also still remove create permissions from users and instead have them send the data to the cloud, and do validation there. This is often a great blanket security policy, as it leaves far fewer gaps on the client. You can also disable find permissions and do all your querying from cloud functions. These things obfuscate logic of your backend, which is nice.

All the answers are valid ones. There are many ways to mitigate those kind of issues.

You can also use a requires authentication class level permissions (https://docs.parseplatform.org/parse-server/guide/#class-level-permissions)

You can put in place, between the load balancer and your parse-server, some tracking of the requests made by the clients by IP, session token etc... in order to block the requests if you believe they are fraudulous through a rate limiting proxy like nginx https://www.nginx.com/blog/rate-limiting-nginx/

There are many other possibilities and most of them apply to any kind of web app.

You should always remember to:

• Keep your masterKey safe (and rotate it if necessary)
• Always use HTTPS (do not serve on HTTP)