Technical Advisory 10010

Date and Version

Version: 2.53.0

Date: 2024-05-28

Description

Version 2.53.0 optimizes the way tokens are created and migrates them to the v2 implementation already used by OAuth / OIDC tokens created through the session API.

Because of this tokens events are no longer created on the user itself. To be as backwards compatible as possible a separate event is created on the user for the audit log.

Statement

This change was tracked in the following PR: perf(oidc): optimize token creation, which was released in Version 2.53.0

Mitigation

If you use the ListEvents API to check the audit trail of a user or being able to compute Daily or Monthly Active Users, be sure to also include the user.token.v2.added event type in your search if you already query for the user.token.added event type.

Impact

Once this update has been released and deployed, the user.token.added event will no longer be created when a user access token is created, but instead a user.token.v2.added. Existing user.token.added events will be untouched.