docs: add info about --dev parameter

[cyb3rko]

New Pull Request Checklist

• I am not disclosing a vulnerability.
• I am creating this PR in reference to an issue.

Issue Description

Added a brief explanation of what the --dev parameter exactly does to be able to better evaluate if you really need it.

Related issue: #1826

Approach

n/a

TODOs before merging

• A changelog entry is created automatically using the pull request title (do not manually add a changelog entry)

[parse-github-assistant]

Thanks for opening this pull request!

• 🎉 We are excited about your hands-on contribution!

[mtrezza]

Also see this: #962

[cyb3rko]

Fits to what I added I think. It just means that the security bypasses only work if having the same IP as the dashboard.

[mtrezza]

Maybe we can restyle this paragraph as a whole, how about this:

---

The --dev parameter disables production-ready security features. This parameter is useful when running Parse Dashboard on Docker. Using this parameter will:

• allow insecure http connections from anywhere, bypassing the option allowInsecureHTTP
• allow the Parse Server masterKey to be transmitted in cleartext without encryption
• allow dashboard access without user authentication

⚠️ Do not use this parameter when deploying Parse Dashboard in a production environment.

---

This is how I read the changes from #962:

parse-dashboard/Parse-Dashboard/app.js

Lines 91 to 101 in 7c56b75

	if (!options.dev && !requestIsLocal) {
	if (!req.secure && !options.allowInsecureHTTP) {
	//Disallow HTTP requests except on localhost, to prevent the master key from being transmitted in cleartext
	return res.send({ success: false, error: 'Parse Dashboard can only be remotely accessed via HTTPS' });
	}
	if (!users) {
	//Accessing the dashboard over the internet can only be done with username and password
	return res.send({ success: false, error: 'Configure a user to access Parse Dashboard remotely' });
	}
	}

parse-dashboard/Parse-Dashboard/app.js

Lines 141 to 146 in 7c56b75

	//They didn't provide auth, and have configured the dashboard to not need auth
	//(ie. didn't supply usernames and passwords)
	if (requestIsLocal || options.dev) {
	//Allow no-auth access on localhost only, if they have configured the dashboard to not need auth
	return res.json(response);
	}

That means the dev param bypasses allowInsecureHTTP and allows insecure http connections from anywhere, regardless whether from localhost or remote address. That seems to be exactly the intended fix for Docker, because in the PR, they say:

when running with docker, as the local IP address is different from the dashboard, all the security features would light up

[cyb3rko]

I see, so insecure http connections and non-auth access is always allowed on localhost and the --dev parameter is only for docker deployment. Alright.

Added your paragraph to the README.

[mtrezza]

Looks good! Thanks for making the docs more understandable!

[parseplatformorg]

🎉 This pull request has been released in version 3.2.1-alpha.1

[parse-github-assistant]

The label state:released on @alpha cannot be used here.

[parseplatformorg]

🎉 This pull request has been released in version 3.2.1-beta.1

[parseplatformorg]

🎉 This pull request has been released in version 3.2.1