title: Authenticating Parse.com User and Session Server-side
body: <p>I'm currently exploring the Parse platform by building some sample client-side apps with the Parse Javascript SDK. I've decided to abstract the majority of Parse-related logic away from the app and to a RESTful API running on a VPS. The purpose is to make the app as back-end agnostic as possible. </p>
  
  <p>The RESTful API I've built is just an Express.js app that uses the Node.js Parse package.</p>
  
  <p>My question is: When I want to make a request to my REST API, what is the best way to validate the user making the request?</p>
  
  <p>Example: Consider an app where users can have friends:</p>
  
  <ol>
  <li>User logs in on the client-side using Parse.User.logIn() method.</li>
  <li>Client hits the endpoint /users/me/friends on my REST API, which checks if the user has a valid session and returns a list of the user's friends.</li>
  </ol>
  
  <p>So this would require the server-side Parse code to determine:</p>
  
  <ol>
  <li>who the user making the request is, and</li>
  <li>if the current user has a valid session</li>
  </ol>
  
  <p>I've considered using the following approach:</p>
  
  <ol>
  <li>When the user logs in client-side, s/he receives a session token.</li>
  <li>Attach this session token as a header when making API requests.</li>
  <li>On the server, use this session token in combination with the Parse.User.become() method to set a current user and execute the required logic:</li>
  <li>So the express app would handle the above example:</li>
  </ol>
  
  <pre class="lang-js prettyprint-override"><code>router.get("/users/me/friends", function(req, res) {
      var sessionToken = req.headers["sessionToken"];
      Parse.User.become(sessionToken).then(function(user) {
          /* Valid user and session: find and return the users friends */
      }, function(error) {
          /* Invalid: return an error status and the error */
      });
  });
  </code></pre>
  
  <p>Is this a valid way to handle this situation? Are there any problems that I should be aware of if I continue this way? Thanks!</p>