sa-token
Sa-Token 轻量级 Java 权限认证框架核心技能。覆盖登录认证、权限/角色认证、注解鉴权、路由拦截鉴权、Session 会话、踢人下线、Token 有效期策略、框架配置、Token 风格与提交前缀、前后端分离、记住我模式、同端互斥登录、NotLoginException 场景值处理。 StpUtil 是核心门面工具类，提供 login/checkLogin/logout/isLogin/getLoginId/getTokenValue 等全套鉴权 API。 当用户需要 Java Web 项目集成权限认证、使用 StpUtil 进行登录/权限校验、配置路由拦截器或注解鉴权时使用。 不涉及二级认证/封禁/多账号/SSO/OAuth2/微服务/API安全/JWT/Redis 等高级功能，请使用对应专项技能。
- Installs
- 77
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token 核心权限认证框架
基于 Sa-Token v1.45.0 | 官方文档：https://sa-token.cc | GitHub：https://github.com/dromara/sa-token
Sa-Token 是一个轻量级 Java 权限认证框架，核心包零依赖，提供了完整的鉴权体系。StpUtil 是其核心门面工具类。
Capability Boundaries
✅ Strong Suits
- 登录认证 —
StpUtil.login()会话登录、记住我模式、指定设备类型、登录扩展参数 - 会话校验 —
StpUtil.isLogin()/checkLogin()/getLoginId()全套查询 API - Token 管理 — 获取 token 值/名称/信息、根据 token 反查账号、token 有效期双策略（timeout + active-timeout）
- 权限/角色认证 — 实现 StpInterface 定义权限加载器、checkPermission/checkRole 系列 API、权限通配符
* - 注解鉴权 —
@SaCheckLogin、@SaCheckPermission、@SaCheckRole、@SaIgnore、@SaCheckOr - 路由拦截鉴权 — SaInterceptor + SaRouter 匹配链、stop/back/free 退出机制、多条件匹配
- Session 会话 — Account-Session / Token-Session / Custom-Session 三种模型
- 踢人下线 — 强制注销、踢下线、顶下线三种操作
- 框架配置 — application.yml 全配置项、代码配置方式
- 前后端分离 — Cookie 模式 vs Header 模式，小程序/APP 无 Cookie 适配
- Token 自定义 — 6 种内置风格、自定义生成策略、Bearer 提交前缀
- 同端互斥登录 — 同一设备类型仅允许一个在线
❌ Out of Scope（替代方案）
- 二级认证/账号封禁/模拟他人/多账号 → sa-token-advanced
- SSO 单点登录 → sa-token-sso
- OAuth2.0 服务端 → sa-token-oauth2
- 微服务 Same-Token/网关鉴权 → sa-token-micro
- API 签名/API Key/临时 Token → sa-token-api-security
- JWT 集成/Redis 持久化/模板引擎 → sa-token-integration
适用场景
当用户需要以下场景时，激活此技能：
- 新项目集成权限认证 — SpringBoot项目引入Sa-Token，配置StpInterface，实现登录/权限校验
- 现有项目添加鉴权 — 为已有接口添加登录校验/权限校验/角色校验
- 配置路由拦截器 — 统一拦截所有请求，按模块划分不同鉴权规则
- 使用注解鉴权 — 使用@SaCheckLogin/@SaCheckPermission等注解
- 前后端分离适配 — 无Cookie环境下Token的传递与校验
- 调试与排错 — 排查NotLoginException各类场景值、Token有效期问题
Workflow
Step 1. 引入依赖 — 添加 sa-token-spring-boot-starter 依赖（根据SpringBoot版本选择）
Step 2. 配置框架 — application.yml 配置 token 名称、有效期、风格等
Step 3. 实现 StpInterface — 自定义权限加载器，返回权限码和角色集合
Step 4. 登录认证 — 调用 StpUtil.login(id) 完成会话登录
Step 5. 权限校验 — 使用 StpUtil 方法或注解进行权限/角色校验
Step 6. 路由拦截 — SaInterceptor + SaRouter 实现全局路由鉴权
Step 7. 集成测试 — 验证登录/注销/权限校验/注解鉴权全流程
StpUtil 核心 API 速查
// === 登录认证 ===
StpUtil.login(Object loginId); // 会话登录
StpUtil.login(10001, "PC"); // 指定设备类型
StpUtil.login(10001, true); // 指定记住我
StpUtil.login(10001, new SaLoginParameter()...); // 完整参数模式
StpUtil.logout(); // 当前会话注销
StpUtil.logout(10001); // 指定账号注销
StpUtil.logoutByTokenValue(token); // 指定Token注销
StpUtil.logoutByLoginId(10001, "PC"); // 指定账号+设备注销
StpUtil.kickout(10001); // 踢人下线
StpUtil.kickoutByTokenValue(token); // 根据Token值踢人
StpUtil.isLogin(); // 是否登录(true/false)
StpUtil.checkLogin(); // 校验登录(未登录抛NotLoginException)
// === 会话/Token查询 ===
StpUtil.getLoginId(); // 当前账号id
StpUtil.getLoginIdAsString()/AsInt()/AsLong(); // 类型化获取
StpUtil.getLoginIdDefaultNull(); // 未登录返回null
StpUtil.getLoginIdByToken(token); // 根据token查账号
StpUtil.getTokenValue(); // 当前token值
StpUtil.getTokenValueByLoginId(10001); // 获取指定账号的token值
StpUtil.getTokenListByLoginId(10001); // 获取指定账号所有token列表
StpUtil.getTokenName(); // token名称(satoken)
StpUtil.getTokenTimeout(); // 剩余有效期(秒)
StpUtil.getTokenInfo(); // 完整TokenInfo
StpUtil.setTokenValue("xxx-xxx"); // 手动设置当前会话token值
StpUtil.renewRefresh(); // 自动续签token有效期
StpUtil.getTerminalListByLoginId(10001); // 获取指定账号所有终端列表
// === 权限/角色校验 ===
StpUtil.getPermissionList(); // 权限码集合
StpUtil.hasPermission("user.add"); // boolean
StpUtil.checkPermission("user.add"); // 失败抛NotPermissionException
StpUtil.checkPermissionAnd("add","del","get"); // 全部拥有
StpUtil.checkPermissionOr("add","del","get"); // 至少一个
StpUtil.hasRole("admin"); // boolean
StpUtil.checkRole("admin"); // 失败抛NotRoleException
// === Session会话 ===
StpUtil.getSession(); // 当前账号Account-Session
StpUtil.getSessionByLoginId(10001); // 指定账号的Session
StpUtil.getTokenSession(); // 当前Token-Session
StpUtil.getTokenSessionByTokenValue("xxx-xxx"); // 按token值获取Token-Session
SaSessionCustomUtil.getSessionById("goods-10001"); // Custom-Session
参考文档
| 主题 | 文件 | 来源 |
|---|---|---|
| 登录认证完整指南 | references/login-auth.md | GitHub |
| 权限/角色认证 | references/jur-auth.md | GitHub |
| 注解鉴权 | references/at-check.md | GitHub |
| 路由拦截鉴权 | references/route-check.md | GitHub |
| Session 会话 | references/session.md | GitHub |
| 框架配置 | references/config.md | GitHub |
| 踢人下线 | references/kickout.md | GitHub |
| Token 有效期 | references/token-timeout.md | GitHub |
| NotLoginException | references/not-login-scene.md | GitHub |
| 前后端分离 & 记住我 | references/not-cookie.md | GitHub、remember-me |
| Token 风格 & 前缀 | references/token-style.md | GitHub、token-prefix |
| 登录参数详解 | references/login-parameter.md | GitHub |
| 同端互斥登录 | references/mutex-login.md | GitHub |
| 快速入门 | examples/quickstart.md | GitHub |
Gotchas
- StpInterface 不会在启动时执行 — 只在调用鉴权方法时触发查询
- 注解鉴权默认关闭 — 必须手动注册
SaInterceptor - SaSession ≠ HttpSession — 两者无任何关系，不要混淆使用
- 前端鉴权只是辅助 — 不能替代后端校验
@SaIgnore只对 SaInterceptor 和 AOP 生效 — 自定义拦截器不受影响@SaCheckPermission默认 AND 模式 — OR 模式需指定mode = SaMode.ORStpUtil.logout()注销范围可通过logout-range配置 — 默认只注销当前 token- Cookie 模式默认注入 Cookie — 关闭可用
is-read-cookie: false
Data Privacy
本技能不收集、存储或传输任何用户数据。
FAQ
What does the sa-token skill do?
Sa-Token 轻量级 Java 权限认证框架核心技能。覆盖登录认证、权限/角色认证、注解鉴权、路由拦截鉴权、Session 会话、踢人下线、Token 有效期策略、框架配置、Token 风格与提交前缀、前后端分离、记住我模式、同端互斥登录、NotLoginException 场景值处理。 StpUtil 是核心门面工具类，提供 login/checkLogin/logout/isLogin/getLoginId/getTokenValue 等全套鉴权 API。 当用户需要 Java Web 项目集成权限认证、使用 StpUtil 进行登录/权限校验、配置路由拦截器或注解鉴权时使用。 不涉及二级认证/封禁/多账号/SSO/OAuth2/微服务/API安全/JWT/Redis 等高级功能，请使用对应专项技能。
How do I install sa-token?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token/ (personal) or .claude/skills/sa-token/ (project).
Which AI agents can use sa-token?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 77 recorded installs.
More from full-stack-skills/java-skills
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合，基于阿里巴巴Java开发手册（嵩山版）。 涵盖7大维度：编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要：(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词：Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
mybatis-plus-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范（SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性）。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
mybatis-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
redis-redisson-patterns
full-stack-skills/java-skills
Redis + Redisson 缓存与分布式锁技能。覆盖缓存Key命名规范、过期时间设置原则、RedisTemplate序列化选择(JSON vs JDK vs String)、Redisson分布式锁三大模式(watchDog/tryLock 有leaseTime/无leaseTime 决策)、缓存穿透(布隆/空值缓存)/击穿(互斥锁)/雪崩(随机TTL)防护、Caffeine vs Redis选择决策。 纠正 LLM：不设过期时间、StringRedisTemplate和RedisTemplate混用、Redisson锁不 try-finally unlock、看门狗在指定 leaseTime 时不生效。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.