feat: add supertokens_min_cdi_version config

tamassoltesz · tamassoltesz · commit 74664a6dd0f2 · 2026-07-27T16:41:40.000+02:00
Rejects requests using a CDI version below a configured minimum (400). Useful for
refusing older CDI versions entirely. Validated as a supported version and &lt;= max.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -9,6 +9,7 @@ to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 - Security: app-specific management APIs now reject non-public/unknown tenant paths on every CDI version (the public-tenant guard was only enforced for CDI >= 5.0, letting `/sometenant/recipe/...` on CDI 3.0-4.0 bypass it)
 - Security: the api-key and IP-allow/deny checks no longer fail open when the request's tenant does not exist; they resolve against the app's public tenant instead
+- Adds `supertokens_min_cdi_version` config to reject requests using a CDI version below a configured minimum
 - Adds CDI 5.5: webauthn sign-in options are single-use — consumed atomically on successful sign in (replay returns `OPTIONS_NOT_FOUND_ERROR`); requests on CDI <= 5.4 are unaffected. Requires SDKs on CDI 5.5 to verify each assertion exactly once (see supertokens-core#1195)
 - Adds `removeOptions_Transaction` to `WebAuthNSQLStorage` (plugin-interface addition; needs a plugin-interface version bump at release)
 
diff --git a/config.yaml b/config.yaml
@@ -148,6 +148,12 @@ core_config_version: 0
 # supertokens_max_cdi_version:
 
 
+# (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). The minimum CDI version that the core will accept. Requests
+# using a CDI version lower than this are rejected with a 400. When set to null, all CDI versions supported by the
+# core are accepted.
+# supertokens_min_cdi_version:
+
+
 # (OPTIONAL | Default: null) string value. If specified, the supertokens service will only load the specified CUD even
 # if there are more CUDs in the database and block all other CUDs from being used from this instance.
 # supertokens_saas_load_only_cud:
diff --git a/devConfig.yaml b/devConfig.yaml
@@ -148,6 +148,11 @@ bcrypt_log_rounds: 4
 # CDI.
 # supertokens_max_cdi_version:
 
+# (DIFFERENT_ACROSS_APPS | OPTIONAL | Default: null). The minimum CDI version that the core will accept. Requests
+# using a CDI version lower than this are rejected with a 400. When set to null, all CDI versions supported by the
+# core are accepted.
+# supertokens_min_cdi_version:
+
 # (OPTIONAL | Default: null) string value. If specified, the supertokens service will only load the specified CUD even
 # if there are more CUDs in the database and block all other CUDs from being used from this instance.
 # supertokens_saas_load_only_cud:
diff --git a/src/main/java/io/supertokens/config/CoreConfig.java b/src/main/java/io/supertokens/config/CoreConfig.java
@@ -370,6 +370,17 @@ public class CoreConfig {
                     "null)")
     private String supertokens_max_cdi_version = null;
 
+    @EnvName("SUPERTOKENS_MIN_CDI_VERSION")
+    @NotConflictingInApp
+    @JsonProperty
+    @HideFromDashboard
+    @ConfigDescription(
+            "The minimum CDI version that the core will accept. Requests using a CDI version lower than this are " +
+                    "rejected with a 400. Useful for refusing older CDI versions entirely (for example to require " +
+                    "the tenant-scope enforcement that applies from CDI 5.0). When set to null, all CDI versions " +
+                    "supported by the core are accepted. (Default: null)")
+    private String supertokens_min_cdi_version = null;
+
     @EnvName("SUPERTOKENS_SAAS_LOAD_ONLY_CUD")
     @ConfigYamlOnly
     @JsonProperty
@@ -964,6 +975,23 @@ void normalizeAndValidate(Main main, boolean includeConfigFilePath) throws Inval
             }
         }
 
+        if (supertokens_min_cdi_version != null) {
+            SemVer minVersion;
+            try {
+                minVersion = new SemVer(supertokens_min_cdi_version);
+            } catch (IllegalArgumentException e) {
+                throw new InvalidConfigException("supertokens_min_cdi_version is not a valid semantic version");
+            }
+            if (!WebserverAPI.supportedVersions.contains(minVersion)) {
+                throw new InvalidConfigException("supertokens_min_cdi_version is not a supported version");
+            }
+            if (supertokens_max_cdi_version != null
+                    && minVersion.greaterThan(new SemVer(supertokens_max_cdi_version))) {
+                throw new InvalidConfigException(
+                        "supertokens_min_cdi_version cannot be greater than supertokens_max_cdi_version");
+            }
+        }
+
         if (bulk_migration_parallelism < 1) {
             throw new InvalidConfigException("Provided bulk_migration_parallelism must be >= 1");
         }
@@ -1292,6 +1320,10 @@ public String getMaxCDIVersion() {
         return this.supertokens_max_cdi_version;
     }
 
+    public String getMinCDIVersion() {
+        return this.supertokens_min_cdi_version;
+    }
+
     private boolean isAnySet(List<String> configs){
         for (String config : configs){
             if(config!=null){
diff --git a/src/main/java/io/supertokens/webserver/WebserverAPI.java b/src/main/java/io/supertokens/webserver/WebserverAPI.java
@@ -617,6 +617,20 @@ protected String getRIDFromRequest(HttpServletRequest req) {
         return req.getHeader("rId");
     }
 
+    public SemVer getMinCDIVersionForRequest(HttpServletRequest req) throws ServletException {
+        String minCDIVersionStr = null;
+        try {
+            minCDIVersionStr = Config.getConfig(
+                    getAppIdentifierWithoutVerifying(req).getAsPublicTenantIdentifier(), main).getMinCDIVersion();
+        } catch (TenantOrAppNotFoundException e) {
+            // ignore missing app; there is no configured minimum to enforce
+        }
+        if (minCDIVersionStr != null) {
+            return new SemVer(minCDIVersionStr);
+        }
+        return null;
+    }
+
     protected SemVer getVersionFromRequest(HttpServletRequest req) throws ServletException {
         SemVer maxCDIVersion = getLatestCDIVersionForRequest(req);
         String version = req.getHeader("cdi-version");
@@ -629,6 +643,13 @@ protected SemVer getVersionFromRequest(HttpServletRequest req) throws ServletExc
                         new BadRequestException("cdi-version " + versionFromRequest + " not supported"));
             }
 
+            SemVer minCDIVersion = getMinCDIVersionForRequest(req);
+            if (minCDIVersion != null && versionFromRequest.lesserThan(minCDIVersion)) {
+                throw new ServletException(new BadRequestException(
+                        "cdi-version " + versionFromRequest + " is lower than the minimum allowed version "
+                                + minCDIVersion));
+            }
+
             return versionFromRequest;
         }
 
diff --git a/src/test/java/io/supertokens/test/CDIVersionTest.java b/src/test/java/io/supertokens/test/CDIVersionTest.java
@@ -470,4 +470,137 @@ public void testAPIVersionsWhenMaxCDIVersionIsSet() throws Exception {
         assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
     }
 
+    @Test
+    public void testMinCDIVersionInvalidSemanticVersion() throws Exception {
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        Utils.setValueInConfig("supertokens_min_cdi_version", "5.x");
+        process.startProcess();
+
+        ProcessState.EventAndException state = process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.INIT_FAILURE);
+        assertNotNull(state);
+        assertEquals("supertokens_min_cdi_version is not a valid semantic version",
+                state.exception.getCause().getMessage());
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
+    @Test
+    public void testMinCDIVersionUnsupportedVersion() throws Exception {
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        Utils.setValueInConfig("supertokens_min_cdi_version", "\"4.5\"");
+        process.startProcess();
+
+        ProcessState.EventAndException state = process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.INIT_FAILURE);
+        assertNotNull(state);
+        assertEquals("supertokens_min_cdi_version is not a supported version",
+                state.exception.getCause().getMessage());
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
+    @Test
+    public void testMinCDIVersionCannotBeGreaterThanMaxCDIVersion() throws Exception {
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        Utils.setValueInConfig("supertokens_max_cdi_version", "\"5.0\"");
+        Utils.setValueInConfig("supertokens_min_cdi_version", "\"5.4\"");
+        process.startProcess();
+
+        ProcessState.EventAndException state = process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.INIT_FAILURE);
+        assertNotNull(state);
+        assertEquals("supertokens_min_cdi_version cannot be greater than supertokens_max_cdi_version",
+                state.exception.getCause().getMessage());
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
+    @Test
+    public void testRequestBelowMinCDIVersionIsRejected() throws Exception {
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        Utils.setValueInConfig("supertokens_min_cdi_version", "\"5.0\"");
+        process.startProcess();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED));
+
+        // versions in [3.0, 5.0) are rejected
+        for (String belowMin : new String[]{"3.0", "3.1", "4.0"}) {
+            try {
+                HttpRequestForTesting.sendGETRequest(process.getProcess(), "",
+                        "http://localhost:3567/recipe/jwt/jwks", null, 1000, 1000, null, belowMin, "jwt");
+                fail("cdi-version " + belowMin + " should have been rejected as below the minimum");
+            } catch (HttpResponseException e) {
+                assertEquals(400, e.statusCode);
+                assertTrue(e.getMessage().contains(
+                        "cdi-version " + belowMin + " is lower than the minimum allowed version 5.0"));
+            }
+        }
+
+        // the minimum itself and versions above it are accepted
+        HttpRequestForTesting.sendGETRequest(process.getProcess(), "",
+                "http://localhost:3567/recipe/jwt/jwks", null, 1000, 1000, null, "5.0", "jwt");
+        HttpRequestForTesting.sendGETRequest(process.getProcess(), "",
+                "http://localhost:3567/recipe/jwt/jwks", null, 1000, 1000, null, "5.4", "jwt");
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
+    @Test
+    public void testWithoutMinCDIVersionOldVersionsAreAccepted() throws Exception {
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        process.startProcess();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED));
+
+        // control: no minimum configured, so an old CDI version is still accepted
+        HttpRequestForTesting.sendGETRequest(process.getProcess(), "",
+                "http://localhost:3567/recipe/jwt/jwks", null, 1000, 1000, null, "3.0", "jwt");
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
+    @Test
+    public void testMinCDIVersionBlocksGhostTenantOldCdiBypass() throws Exception {
+        // Defense in depth for the ghost-tenant bypass: setting the minimum to 5.0 refuses the
+        // vulnerable CDI window (3.0-4.0) outright, before the request reaches any handler.
+        String[] args = {"../"};
+
+        TestingProcessManager.TestingProcess process = TestingProcessManager.startIsolatedProcess(args, false);
+        Utils.setValueInConfig("supertokens_min_cdi_version", "\"5.0\"");
+        process.startProcess();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STARTED));
+        if (StorageLayer.getStorage(process.getProcess()).getType() != STORAGE_TYPE.SQL) {
+            return;
+        }
+
+        JsonObject body = new JsonObject();
+        body.addProperty("role", "ldvr-min-cdi");
+        JsonArray permissions = new JsonArray();
+        permissions.add("read");
+        body.add("permissions", permissions);
+
+        try {
+            HttpRequestForTesting.sendJsonPUTRequest(process.getProcess(), "",
+                    "http://localhost:3567/ghosttenant/recipe/role", body, 10000, 10000, null, "3.0", "userroles");
+            fail("ghost-tenant create on CDI 3.0 must be rejected when min_cdi_version is 5.0");
+        } catch (HttpResponseException e) {
+            assertEquals(400, e.statusCode);
+            assertTrue(e.getMessage().contains("is lower than the minimum allowed version 5.0"));
+        }
+
+        process.kill();
+        assertNotNull(process.checkOrWaitForEvent(ProcessState.PROCESS_STATE.STOPPED));
+    }
+
 }
