LoginSign Up
← Back to all sparks
C

Casdoor

INFRA · APIS
Velocity5.0

Open-source identity and access management platform with SSO and OAuth.

casdoor.org ↗

Casdoor ships a minor version per commit, and every one of them is login-flow repair

identityssoldappassword-recoverysession-managementopen-source
◆Current state
Casdoor is an open-source identity and access-management platform, currently releasing at roughly one minor version per merged change — ten releases across ten days in this window. Every entry is labelled a Feature, but the substance is repair work on account recovery, LDAP group handling, session lifecycle, and the device-code flow.
◆Where it's heading
Two clusters dominate. The first is password recovery: provider categories were masked, verification methods appeared without a backing Email or SMS provider, and placeholder copy did not reflect what was actually configured — three releases to make one flow behave. The second is session and identity plumbing: capturing the Beego session id before regeneration so logout actually deletes the row, preserving device userCode through a social-login round-trip, and populating last sign-in time and IP. The versioning inflates cadence considerably; a 3.116-to-3.125 span reads like nine releases and is closer to nine commits.
◆Prediction
The password-recovery and LDAP group paths have each absorbed several consecutive releases without settling, so expect the next run of minors to keep landing in those two areas rather than opening new surface.

◆Recent moves

  1. 4d ago

    Logout now actually deletes the stored session row

    Captures the Beego session id before regeneration so logout can delete the matching database row. A session that survives its own logout is the kind of defect that matters more in an IAM product than the one-line changelog suggests.

    View source ↗
  2. 5d ago

    Device code survives the social-login round-trip

    Preserves the device userCode across a social-login redirect, closing a break in the device authorization flow. Fits the session-continuity thread running through this release run.

    View source ↗
  3. 7d ago

    Forgot-password placeholder matches configured providers

    Adjusts placeholder text on the password-recovery form to reflect which providers are configured. Copy-level polish on the same flow the two preceding releases repaired functionally.

    View source ↗
  4. 7d ago

    Email lookups match case-insensitively

    Makes email matching case-insensitive in an internal lookup helper. A narrow correctness fix that most deployments would never trip over.

    View source ↗
  5. 8d ago

    Password-grant tokens report the previous sign-in time correctly

    Keeps lastSigninTime pointing at the previous login rather than the current one when issuing a password-grant token. Small, but it is audit data administrators read and act on.

    View source ↗
  6. 8d ago

    Unmasking provider categories restores password recovery

    Email and SMS provider categories were masked, which broke forgot-password outright. This is the functional half of the recovery-flow cluster that the following two releases then finished tidying.

    View source ↗