LoginSign Up
← Back to all sparks
S

SuperTokens

INFRA · APIS
Velocity2.5

Open-source user authentication and session management for web and mobile.

supertokens.com ↗

SuperTokens patches seven auth advisories and makes SAML IdP-initiated login opt-in by allow-list.

authself-hostedsamlsecuritymulti-tenantactivity-log
◆Current state
SuperTokens is a self-hostable auth backend that spent the v12 cycle hardening its security surface and extending multi-tenancy. The v12.3.0 canary in September added an append-only activity log for user lifecycle events. v12.0.11 is a security release: SAML replay protection and single-assertion binding, an ACS URL allow-list now required for IdP-initiated logins, tenant-scoped WebAuthn sign-in, a session/unlink race fix and dashboard session expiry checks, with additive schema migrations.
◆Where it's heading
Two tracks run in parallel: a stable 12.0 line that keeps closing authentication edge cases, much of it in SAML, and a 12.3 canary that adds stateful features such as the activity log. The new ACS allow-list requirement shows the project is willing to refuse insecure configurations by default rather than leave them to documentation.
◆Prediction
Expect further 12.0.x security patches and, separately, the 12.3 activity log moving toward a stable release; the entries don't show when it will get a read API.

◆Recent moves

  1. 11d ago

    SuperTokens 12.0.11: SAML replay protection and seven security fixes

    A security release covering seven advisories, including SAML replay protection and a new ACS URL allow-list that existing IdP-initiated clients must set before logins resume. It continues the 12.0 hardening track, and SAML operators need to act on upgrade.

    View source ↗
  2. 1mo ago

    SuperTokens v12.3: Activity log and lifecycle event system

    ⚡ SPARK

    The v12.3.0 canary lands a complete lifecycle event system — user creation, deletion, tenant disassociation, and account linking all emit into an append-only activity log. User counts are now derived from ledger folds instead of direct writes, and a rollup cron keeps per-storage counts accurate for separate-database tenants. This is the largest architectural addition to SuperTokens core since multi-tenancy landed.

    View source ↗
  3. 2mo ago

    SuperTokens v12.0.10: SAML hardening

    A single SAML security patch with no other user-visible changes. Maintenance-tier fix in an otherwise active development period.

    View source ↗
  4. 3mo ago

    SuperTokens v12.0.5: Account linking fixes and migration guard

    Account linking bug fixes and a guard that prevents transitioning to MIGRATED migration mode while inconsistent users exist — closing a data integrity gap for teams running multi-tenant auth migrations. The supertokens-agent-runner bot making its first contribution signals automated tooling entering the core development loop.

    View source ↗
  5. 4mo ago

    v12.0.4-canary

    A canary cut with no documented changes — a version bump in the release chain with no visible user impact.

    View source ↗
  6. 4mo ago

    SuperTokens v12.0.3: Activity log table integration begins

    The first integration of the activity_log table into core, laying the storage foundation for the lifecycle event system that fully lands in v12.3.0. Visible in hindsight as the first public commit of a months-long architectural project.

    View source ↗