sa-token-advanced
Sa-Token 高级安全特性技能。覆盖二级认证(safe-auth二次验证)、账号封禁(全封禁/分类封禁/阶梯封禁)、模拟他人与身份切换、多账号认证(StpUserUtil/StpKit)、全局侦听器(登录/注销/踢人/封禁/续签事件)、全局过滤器(SaServletFilter/SaReactorFilter)、密码加密(MD5/SHA1/SHA256/AES/RSA/BCrypt/TOTP)、会话查询(终端列表/全局搜索Token)、Http Basic/Digest认证、防火墙(IP黑白名单/频率限制)、自定义鉴权注解、路由鉴权动态化、反向代理URI修复、异步Mock上下文、数据架构Redis键值设计。 当用户需要实现敏感操作二次验证、账号分级封禁、模拟用户操作、多套账号体系(User/Admin分离)、全局事件监听、密码加密工具时使用。 基础登录认证请使用 sa-token 技能。
- Installs
- 76
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-advanced- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token-advanced automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token 高级安全特性
基于 sa-token-doc/up/深入 + fun/高级 + arch/架构文档。
适用场景
当用户需要以下场景时，激活此技能：
- 敏感操作二次验证 — 删除仓库/修改密码等操作需要再次确认身份
- 账号违规处罚 — 按服务维度封禁（只禁言不禁购）、按违规等级处罚
- 后台模拟用户 — 客服人员需要临时以用户身份操作
- 多套账号体系 — 系统中同时存在User和Admin两套独立的账号表
- 全局事件记录 — 记录所有用户的登录/注销/踢人/封禁等操作日志
- 密码加密存储 — 用户密码的安全存储与验证
Workflow
Step 1. 确定需求 — 选择二级认证/封禁/多账号/侦听器等具体功能 Step 2. 编写代码 — 根据API文档实现对应功能 Step 3. 配置注册 — 注册侦听器、配置过滤器、定义多账号体系 Step 4. 测试验证 — 验证功能行为符合预期
Capability Boundaries
✅ Strong Suits
- 二级认证 —
openSafe()/checkSafe()/@SaCheckSafe敏感操作二次验证 - 账号封禁 — 全封禁/分类封禁(comment/order/shop)/阶梯封禁(level)
- 身份切换 —
switchTo()/endSwitch()模拟其他账号 - 多账号认证 — StpUserUtil模式 + StpKit门面模式，多套账号体系
- 全局侦听器 — SaTokenListener接口(登录/注销/踢人/封禁等10+事件)
- 全局过滤器 — SaServletFilter + SaReactorFilter，统一安全头设置
- 密码加密 — 5种算法：MD5/SHA/AES/RSA/BCrypt + TOTP验证码
- 会话查询 — SaTerminalInfo终端列表 + searchTokenValue/TokenSession/Session
- Http Basic/Digest — @SaCheckHttpBasic / @SaCheckHttpDigest
- 防火墙 — IP黑白名单 + 请求频率限制
- 自定义注解 — 组合注解/自定义鉴权注解
⚠️ Requirements
- 所有功能都基于
sa-token-core，部分功能需要登录后才能使用 - 全局侦听器需要注册到Spring容器（@Component或手动注册）
- 多账号认证需要自行定义账号体系名称
❌ Out of Scope
- 基础登录/权限/注解鉴权 → sa-token
- SSO单点登录 → sa-token-sso
- OAuth2.0 服务端 → sa-token-oauth2
- 微服务鉴权 → sa-token-micro
参考文档
| 主题 | 文件 | 来源 |
|---|---|---|
| 二级认证(safe-auth) | references/safe-auth.md | GitHub |
| 账号封禁(分类+阶梯) | references/disable.md | GitHub |
| 身份切换(mock-person) | references/mock-person.md | GitHub |
| 多账号认证 | references/many-account.md | GitHub |
| 密码加密+HttpBasic | references/password-basic.md | GitHub |
| 全局侦听器+全局过滤器 | references/listener-filter.md | GitHub |
核心 API 速查
// === 二级认证 ===
StpUtil.openSafe("update-password"); // 开启(默认120秒)
StpUtil.checkSafe("update-password"); // 校验
@SaCheckSafe("update-password") // 注解
// === 账号封禁 ===
StpUtil.disable(10001, "comment", 200); // 分类封禁
StpUtil.disableLevel(10001, "comment", 2, 200); // 阶梯封禁
StpUtil.untieDisable(10001, "comment"); // 解封
@SaCheckDisable("comment") // 注解
// === 身份切换 ===
StpUtil.switchTo(10001); // 切换到其他账号
StpUtil.switchTo(10001, () -> { ... }); // Lambda作用域切换
// === 多账号 ===
StpUserUtil.login(10001); // User体系
StpKit.admin.login(10001); // StpKit门面
// === 密码加密 ===
SaSecureUtil.md5("123456");
SaSecureUtil.aesEncrypt(key, "data");
SaSecureUtil.rsaEncryptByPublic(publicKey, text);
SaTotpUtil.generateCode("secret");
SaSecureUtil.bCryptPasswordEncoder("123456");
// === 全局侦听器 ===
SaTokenEventCenter.registerListener(listener);
@Component class MyListener extends SaTokenListenerForSimple { ... }
// === 会话查询 ===
StpUtil.searchTokenValue(keyword, start, size, sort);
StpUtil.searchSessionId(keyword, start, size, sort);
FAQ
Q: 二级认证和普通登录有什么区别？ A: 普通登录是第一次身份验证。二级认证是在已经登录的基础上，对敏感操作进行第二次验证（如修改密码、删除仓库）。两者独立。
Q: 账号封禁的三种级别怎么用？ A: 简单违规用全封禁。按服务维度违规用分类封禁（如只禁言不禁购）。需要梯度处罚用阶梯封禁（如首次违规level1，多次违规level3）。
Q: StpUserUtil和StpKit有什么区别？ A: StpUserUtil是内置的User账号体系。StpKit门面模式可以自定义任意多的账号体系（如User、Admin、Teacher），更加灵活。
Q: 全局侦听器能监听到哪些事件？ A: 登录、注销、踢下线、顶下线、封禁、解封、二级认证开启/关闭、Session创建/销毁、Token续期，共11种事件。
Q: SaServletFilter和SaInterceptor怎么选？ A: 需要过滤静态资源或设置安全响应头选SaServletFilter。只需要Controller层鉴权选SaInterceptor。两者可以同时使用。
Q: 如何自定义鉴权注解？
A: 实现 SaAnnotationStrategy 的自定义注解处理器，可以参考官方demo中的 custom_annotation 包。
Gotchas
- StpInterface可实现
isDisabled()自定义封禁逻辑 — 默认封禁在内存中，重启丢失 - 多账号体系可在注解中通过
type属性指定 — 如@SaCheckLogin(type = "user") - 全局侦听器建议使用
SaTokenListenerForSimple简化实现 — 只重写需要的方法 - 二级认证默认有效期120秒 — 可根据业务调整
- 阶梯封禁的level值越大代表封禁越严重 —
checkDisableLevel(3)表示level≥3才阻止 - switchTo的Lambda方式比手动endSwitch更安全 — 不会忘记恢复身份
- 全局过滤器设置安全响应头时要注意浏览器兼容性
- Http Basic认证的账号密码在网络传输中是明文 — 需配合HTTPS使用
Data Privacy
本技能不收集、存储或传输任何用户数据。所有代码示例仅供本地开发参考。
FAQ
What does the sa-token-advanced skill do?
Sa-Token 高级安全特性技能。覆盖二级认证(safe-auth二次验证)、账号封禁(全封禁/分类封禁/阶梯封禁)、模拟他人与身份切换、多账号认证(StpUserUtil/StpKit)、全局侦听器(登录/注销/踢人/封禁/续签事件)、全局过滤器(SaServletFilter/SaReactorFilter)、密码加密(MD5/SHA1/SHA256/AES/RSA/BCrypt/TOTP)、会话查询(终端列表/全局搜索Token)、Http Basic/Digest认证、防火墙(IP黑白名单/频率限制)、自定义鉴权注解、路由鉴权动态化、反向代理URI修复、异步Mock上下文、数据架构Redis键值设计。 当用户需要实现敏感操作二次验证、账号分级封禁、模拟用户操作、多套账号体系(User/Admin分离)、全局事件监听、密码加密工具时使用。 基础登录认证请使用 sa-token 技能。
How do I install sa-token-advanced?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-advanced in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token-advanced/ (personal) or .claude/skills/sa-token-advanced/ (project).
Which AI agents can use sa-token-advanced?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token-advanced safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token-advanced?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 76 recorded installs.
More from full-stack-skills/java-skills
mybatis-plus-patterns
full-stack-skills/java-skills
MyBatis-Plus 增强 ORM 技能。覆盖 LambdaQueryWrapper vs QueryWrapper选择(始终Lambda)、分页插件(PaginationInnerInterceptor)配置、乐观锁(@Version + OptimisticLockerInnerInterceptor)、逻辑删除(@TableLogic 全局/局部配置)、自动填充(@TableField fill + MetaObjectHandler)、ActiveRecord vs Mapper模式选择、防全表更新(BlockAttackInnerInterceptor)、通用PageQuery抽取。 当用户使用 MyBatis-Plus 进行数据库操作、配置分页乐观锁、选择查询方式时使用。 与 mybatis 技能互补：mybatis 侧重XML/ResultMap/SQL写法，mybatis-plus 侧重增强功能。
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合，基于阿里巴巴Java开发手册（嵩山版）。 涵盖7大维度：编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要：(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词：Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
mybatis-patterns
full-stack-skills/java-skills
MyBatis 核心 ORM 技能。覆盖 XML vs 注解 SQL选择、ResultMap复用(extends)、关联查询(association/collection join vs 嵌套select/N+1决策)、分页插件配置、和$的SQL注入防护、动态SQL(if/where/set/foreach/choose)最佳实践、columnPrefix解决同表多次JOIN。 当用户编写 MyBatis Mapper XML、处理关联查询、配置分页、防范SQL注入时使用。
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范（SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性）。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
junit-mockito-patterns
full-stack-skills/java-skills
JUnit5 + Mockito 测试框架技能。覆盖 JUnit5 @ExtendWith替代@RunWith、Mockito @Mock/@InjectMocks规则、测试隔离原则(FIRST)、@SpringBootTest何时用何时不用(@WebMvcTest/@DataJpaTest切片测试)、BDDMockito given/willReturn风格、ArgumentCaptor参数捕获、verify行为验证、@ParameterizedTest参数化测试。 当用户编写 Java 单元测试/集成测试、Mock外部依赖时需要此技能。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.