fix: Password reset link containing literal `{appId}` instead of application ID by Copilot · Pull Request #10005 · parse-community/parse-server

Copilot · 2026-01-05T15:48:48Z

Pull Request

Report security issues confidentially.
Any contribution is under this license.
Link this pull request to an issue.

Issue

Password reset emails contained URLs with literal {appId} placeholder instead of actual application ID, resulting in 404 errors. Broken in Parse Server 9.x.

Example broken URL:

http://localhost:8080/app/apps/{appId}/request_password_reset?token=...

Approach

Root cause: Config.get() set config.applicationId from parameter but property copying loop could overwrite it. URL builders used unreliable config.applicationId instead of authoritative config.appId from cached server config.

Changes:

src/Config.js
- Skip applicationId when copying cached properties to prevent overwrite
- URL getters (requestResetPasswordURL, verifyEmailURL) now use this.appId
src/Routers/PagesRouter.js
- Page parameter builders now use config.appId instead of config.applicationId
spec/PasswordResetLink.spec.js
- Tests verify email links and rendered pages contain actual app ID
- Tests ensure {appId} placeholder never appears

Tasks

Add tests
Add security check

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

downloads.mongodb.org
- Triggering command: /usr/local/bin/node node /home/REDACTED/work/parse-server/parse-server/node_modules/.bin/mongodb-REDACTED exec -t standalone --version 8.0.4 -- --port 27017 -- npm run testonly (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

Configure Actions setup steps to set up my environment, which run before the firewall is enabled
Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

Original prompt

This section details on the original issue you should resolve

<issue_title>requestPasswordReset email link (“Verify Email” button) redirects to Not Found</issue_title>
<issue_description>### New Issue Checklist

Report security issues confidentially.

Any contribution is under this license.

Before posting search existing issues.

Issue Description

When calling Parse.User.requestPasswordReset(...) from the Parse JavaScript SDK, the password reset email is delivered successfully, but the CTA button/link in the email (labeled “Verify Email”) redirects to a Not Found page when clicked.

Working fine with parse-server version : 8.6.2 and below

Steps to reproduce

Trigger the password reset request using the Parse JS SDK:
await Parse.User.requestPasswordReset(username);

Open the password reset email you receive.

Click the “Verify Email” button/link in the email.

Observe that it redirects to a Not Found page.

Actual Outcome

Clicking the email CTA (“Verify Email”) opens a URL that results in Not Found.

Expected Outcome

Clicking the link in the password reset email should open the Parse Server password reset page/route, allowing the user to set a new password successfully.

Environment

Server

Parse Server version: 9.x.x

Operating system: Windows

Local or remote host (AWS, Azure, Google Cloud, Heroku, Digital Ocean, etc): Local

Client

SDK (iOS, Android, JavaScript, PHP, Unity, etc): Javascript

SDK version: 8.0.0

Logs

<agent_instructions>Create a PR with a failing test to demo the issue described here. Only if the failing test has confirmed the bug, add a fix.</agent_instructions>

Comments on the Issue (you are @copilot in this section)
@mtrezza What is the URL? What's the exact Parse Server version?

Fixes requestPasswordReset email link (“Verify Email” button) redirects to Not Found #9995

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

coderabbitai · 2026-01-05T15:48:55Z

Important

Review skipped

Bot user detected.

To trigger a single review, invoke the @coderabbitai review command.

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

parseplatformorg · 2026-01-05T15:48:59Z

✅ Snyk checks have passed. No issues have been found so far.

Status	Scanner	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

Co-authored-by: mtrezza <5673677+mtrezza@users.noreply.github.com>

mtrezza · 2026-01-06T14:21:23Z

@copilot Why can this.applicationId not be used anymore? What happened to it?

parse-github-assistant · 2026-01-06T14:21:59Z

🚀 Thanks for opening this pull request!

Copilot · 2026-01-06T14:23:55Z

@copilot Why can this.applicationId not be used anymore? What happened to it?

this.applicationId can still be used - it's still set on line 48 and line 52 now protects it from being overwritten by cached config properties.

I changed the URL getters to use this.appId for consistency with existing code (lines 78, 84 in Config.js already use this.appId). Both this.applicationId and this.appId have the same value since applicationId is the parameter used to retrieve the cached config containing appId.

If you prefer to keep using this.applicationId in the URL getters for consistency with the rest of the codebase (triggers.js, RestWrite.js, etc.), I can revert those changes while keeping the line 52 protection. Would you like me to do that?

Initial plan

9db5d2f

Copilot AI assigned Copilot and mtrezza Jan 5, 2026

Copilot started work on behalf of mtrezza January 5, 2026 15:49 View session

Copilot AI and others added 3 commits January 5, 2026 16:03

Identified root cause of password reset link bug

3b672da

Co-authored-by: mtrezza <5673677+mtrezza@users.noreply.github.com>

Fix password reset link to use appId instead of applicationId

4a8a025

Co-authored-by: mtrezza <5673677+mtrezza@users.noreply.github.com>

Address code review feedback for Parse.Query constructor

ab84d65

Co-authored-by: mtrezza <5673677+mtrezza@users.noreply.github.com>

Copilot AI changed the title ~~[WIP] Fix redirect issue with password reset email link~~ Fix password reset link containing literal {appId} instead of application ID Jan 5, 2026

Copilot AI requested a review from mtrezza January 5, 2026 16:13

Copilot finished work on behalf of mtrezza January 5, 2026 16:13

mtrezza marked this pull request as ready for review January 6, 2026 14:21

Copilot started work on behalf of mtrezza January 6, 2026 14:21 View session

mtrezza changed the title ~~Fix password reset link containing literal {appId} instead of application ID~~ fix: Password reset link containing literal {appId} instead of application ID Jan 6, 2026

Copilot finished work on behalf of mtrezza January 6, 2026 14:25

mtrezza closed this Feb 4, 2026

mtrezza deleted the copilot/fix-password-reset-email-link branch February 4, 2026 16:54

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: Password reset link containing literal `{appId}` instead of application ID#10005

fix: Password reset link containing literal `{appId}` instead of application ID#10005
Copilot wants to merge 4 commits intoalphafrom
copilot/fix-password-reset-email-link

Copilot AI commented Jan 5, 2026 •

edited

Loading

Uh oh!

coderabbitai bot commented Jan 5, 2026

Review skipped

Uh oh!

parseplatformorg commented Jan 5, 2026 •

edited

Loading

Uh oh!

mtrezza commented Jan 6, 2026

Uh oh!

parse-github-assistant bot commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Conversation

Copilot AI commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Pull Request

Issue

Approach

Tasks

I tried to connect to the following addresses, but was blocked by firewall rules:

Issue Description

Steps to reproduce

Actual Outcome

Expected Outcome

Environment

Logs

Comments on the Issue (you are @copilot in this section)

Uh oh!

coderabbitai bot commented Jan 5, 2026

Review skipped

Uh oh!

parseplatformorg commented Jan 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

✅ Snyk checks have passed. No issues have been found so far.

Uh oh!

mtrezza commented Jan 6, 2026

Uh oh!

parse-github-assistant bot commented Jan 6, 2026

Uh oh!

Copilot AI commented Jan 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Copilot AI commented Jan 5, 2026 •

edited

Loading

parseplatformorg commented Jan 5, 2026 •

edited

Loading