LoginSign Up
← Back to all sparks
S

SuperTokens

INFRA · APIS
Velocity2.5

Open-source user authentication and session management for web and mobile.

supertokens.com ↗

SuperTokens is hardening SAML and building a migration path off other auth providers.

authenticationsamluser-migrationaccount-linkingopen-source
◆Current state
SuperTokens is an open-source authentication service, and its core repo is running a 12.0 canary line alongside stable patches. The work in this window falls into two piles: SAML security — XML signature wrapping protection in 12.0.2-canary, further hardening in the 12.0.10 release — and migration mode, where new core-user-data records can be created as MIGRATED and the transition is now blocked while inconsistent users exist. Release notes are thin, usually a PR title or two per tag.
◆Where it's heading
Migration mode plus account-linking exploration is the tell: this is infrastructure for importing an existing user base from another provider without breaking identity linkage mid-flight, and the guard added in 12.0.5-canary shows they hit the inconsistent-state case in practice. The SAML work runs in parallel because enterprise SAML is what a team is usually migrating toward. Also worth noting: an automated contributor, supertokens-agent-runner, opened its first PRs in this window, so part of the fix and test volume is now agent-authored.
◆Prediction
A stable 12.x release consolidating the canary migration-mode work is the readable next step, likely once the MIGRATED transition guards have run without incident. More SAML hardening should be expected given two separate fixes landed in this window alone.

◆Recent moves

  1. 13d ago

    SAML hardening lands on the stable 12.0 line

    A single SAML hardening fix shipped to the stable line, following the XML signature wrapping protection added on the canary branch in June. Two SAML security changes in one window suggests the implementation is getting deliberate scrutiny rather than incidental fixes.

    View source ↗
  2. 1mo ago

    Migration mode blocks transition while inconsistent users exist

    The most substantive canary tag: the MIGRATED migration-mode transition is now blocked while inconsistent users are present, alongside account-linking exploration and OpenTelemetry span annotation tweaks. Guarding the transition rather than repairing it afterward is the right call for an import that touches identity linkage. It is also where an automated contributor opened its first PRs on this repo.

    View source ↗
  3. 1mo ago

    12.0.4-canary ships with no described changes

    An empty canary tag carrying only a full-changelog link. It marks a point on the branch rather than a change worth reading.

    View source ↗
  4. 1mo ago

    Activity log table put into use

    Wires up an activity_log table, giving the core somewhere structured to record what happened rather than relying on external log scraping. Paired with a CI fix for release flag handling.

    View source ↗
  5. 2mo ago

    SAML gains XML signature wrapping protection

    Adds protection against XML signature wrapping, an attack class where a valid signature is reused to authenticate attacker-controlled assertions. For a SAML implementation this is a foundational check rather than an optional hardening step.

    View source ↗
  6. 2mo ago

    New core user data records can be created as MIGRATED

    Lets newly created core-user-data records carry the MIGRATED state directly, which is what an import needs in order to write users in their final state instead of transitioning them afterward. The first visible piece of the migration-mode thread the later canaries build on.

    View source ↗