Security with cloud functions using parse.com

Question

I am working with parse.com and looking at making my app secure. I think I have understood well the basics principles of the ACL, CLP, and Cloud functions. My main question comes from the Part IV of the parse.com blog. . By using a cloud function, I should be securing my app, but what prevents someone to call this cloud function multiple time ? The example is the following define in the cloud :

Parse.Cloud.define("like", function(request, response) {
  var post = new Parse.Object("Post");
  post.id = request.params.postId;
  post.increment("likes");
  post.save(null, { useMasterKey: true }).then(function() {
    response.success();
  }, function(error) {
    response.error(error);
  });
});

This should be used in my JS code as:

 Parse.Cloud.run('like', {postId : theIdOfMyPost}).then(function(results){
        // ok
    }, function(err) {
      console.log(err);
    });

Now, if someone looks at my code, he will understand quite quickly what is going on, just call/run this cloud function multiple times, and likes on the post will raise. This is not much of a big deal here, but this could lead to a security breach in more complicated app I believe ?

Answer 1

Behind the scenes, Parse surely has load balancing measures in place to throttle consecutive requests from a single source, usually to increase quality of service as well as detecting and preventing DDos attacks.

The scenario you provided can be prevented using good design on your part. For dealing with having multiple likes from a single user, you restrict a user to be able to Like something only once. Generally you do not let anyone to manipulate your counter directly and increase/decrease this counter only as a by product of a user's action.

Lets say a user likes a photo in your app. In your database, every user object has a Like Relation (which acts kind of like a high-performance list) that keeps track of what photos he has like so far. Every time he likes a photo, you go through this list and if the photo is not in there, you add that photo to this Relation and then bump up the photo's Like counter. When he unlikes the photo, you perform the opposite. This way not only your app can scale up reliably, your counters will not be open to abuse by a malicious user.