sYnID
sYnID is a centralized authentication provider that acts as a universal single sign-on gateway for applications in the sYnVerse ecosystem. Deployed entirely on Cloudflare Workers, it shares active sessions across subdomains, allowing users to sign in once and access all connected services seamlessly.
Infrastructure Overview
Security & Auth Core
| Framework | OpenAuth.js (@openauthjs/openauth) |
| Runtime | Cloudflare Workers |
| Schema Validator | Valibot |
| Bot Shield | Cloudflare Turnstile CAPTCHA |
Data & Storage
| User Database | Cloudflare D1 (SQL) |
| Session Cache | Cloudflare KV Storage |
| Email Integration | Resend API (automated verification & reset) |
| Language | TypeScript |
Shared-Domain Auto-Login: By leveraging parent domain session cookies, sYnID shares one-time authorization tokens across subdomains, instantly logging in users as they navigate between applications without redirect delays.
Core Features
- Multi-Provider Authentication — Integrates classic Email/Password credentials, Google OAuth, GitHub OAuth, and Microsoft Entra ID.
- Account Linking — Allows users to bind multiple OAuth credentials to a single email address, preventing duplicate accounts.
- Post-Based Central Logout — Features a secure, POST-verified logout endpoint that clears cookies across all linked client applications.
- Security Hardening — Protects endpoints with Turnstile CAPTCHA (featuring automatic rate-limit token resets) and prevents browser predictive prefetching from accidentally executing sign-outs.