sa-token-api-security
Sa-Token API 安全防御技能。覆盖 API 参数签名(sa-token-sign)防篡改防重放(timestamp+nonce+sign四步演进)、API Key(sa-token-apikey)部分授权与Scope控制(可吊销/可限权)、临时Token(SaTempUtil内嵌核心包)短效链接邀请。 API签名支持多应用(多secret-key)模式和多种摘要算法(md5/sha256/sha512)。API Key支持多账号体系、数据库持久化模式。临时Token支持前缀裁剪、反向查询、JWT集成。 基础登录认证请先使用 sa-token 技能。
- Installs
- 75
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-api-security- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token-api-security automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token API 安全
基于 sa-token-doc/plugin/api-sign.md（591行）+ api-key.md（283行）+ temp-token.md（120行）。
Capability Boundaries
✅ Strong Suits
- API参数签名 — 跨系统接口防篡改、防重放（timestamp+nonce+sign四步演进）
- 多应用签名模式 — 多套secret-key，不同摘要算法（md5/sha256/sha512）
- API Key管理 — 第三方开发者部分授权、Scope权限控制、可吊销
- API Key多账号体系 — 不同账号体系独立API Key模板
- API Key数据库模式 — 实现DataLoader接口持久化到数据库
- 临时Token — 短效链接邀请、非会话式授权
- 临时Token前缀裁剪 — 按业务线加前缀区分
- 临时Token反向查询 — 根据value反查所有token
⚠️ Requirements
- API签名需要通信双方协商secret-key
- API Key默认保存在缓存中（重启丢失），持久化需实现DataLoader
- 临时Token内嵌核心包，无需额外依赖
❌ Out of Scope
- 基础登录/权限认证 → sa-token
- JWT集成/Redis → sa-token-integration
- 微服务Same-Token → sa-token-micro
什么时候用哪个功能
| 场景 | 推荐方案 | 原因 |
|---|---|---|
| 系统A调用系统B的API，防止参数篡改 | API签名 | 轻量级，不需要额外存储 |
| 给第三方开发者提供API访问凭证 | API Key | 可吊销、可控制Scope权限 |
| 生成一个短期的邀请链接 | 临时Token | 无状态、指定过期时间 |
| 需要同时防篡改+身份认证 | API签名+API Key | 两者可同时使用 |
工作流
API签名工作流
Step 1. 引入 sa-token-sign 依赖
Step 2. 配置 secret-key 和摘要算法
Step 3. 请求端用 SaSignUtil.addSignParamsAndJoin() 构建签名的参数
Step 4. 接收端用 SaSignUtil.checkRequest() 或 @SaCheckSign 校验
API Key工作流
Step 1. 引入 sa-token-apikey 依赖
Step 2. 调用 SaApiKeyUtil.createApiKeyModel() 创建API Key
Step 3. 客户端通过请求参数或header提交apikey
Step 4. 服务端用 @SaCheckApiKey 注解校验
临时Token工作流
Step 1. 调用 SaTempUtil.createToken() 创建临时Token
Step 2. 将Token传递给使用者（URL/消息等）
Step 3. 使用者调用 SaTempUtil.parseToken() 解析
参考文档
| 主题 | 文件 | 来源 |
|---|---|---|
| API参数签名(防篡改防重放) | references/api-sign.md | GitHub |
| API Key(部分授权管理) | references/api-key.md | GitHub |
| 临时Token(短效链接) | references/temp-token.md | GitHub |
FAQ
Q: API签名和Same-Token有什么区别？ A: API签名用于参数防篡改防重放（数据完整性），Same-Token用于服务间身份认证（身份验证）。可同时使用。
Q: API Key和会话Token有什么区别？ A: API Key是静态的、可吊销的、Scope受限的。会话Token是动态的、登录后自动获取的、拥有账号完整权限。场景不同不能互相替代。
Q: 临时Token的有效期怎么设？
A: 创建时通过第二个参数指定（秒），如 SaTempUtil.createToken("10014", 200) 表示200秒。
Q: API Key怎么持久化到数据库？
A: 实现 SaApiKeyDataLoader 接口，框架会先查缓存，缓存不存在时调用DataLoader从数据库加载。
Q: 临时Token能不能JWT模式？
A: 可以。引入 sa-token-temp-jwt 依赖并配置jwt-secret-key，上层API不变，底层使用JWT内核。
Gotchas
- API签名中secret-key不要硬编码在代码中 — 应配置在配置中心或环境变量
- API Key默认保存在缓存中 — 重启后丢失，需要数据库模式请实现DataLoader
- 临时Token创建时不记录索引（第三个参数=false） — 默认无法反查value对应的token
- API前缀裁剪时指定错误前缀会返回null — 不是抛出异常
- API签名的secret-key泄露后需要立即更换 — 更换后所有使用旧key的请求会失败
- 多个API Key可以赋予不同的Scope — 做到最小化授权
- 临时Token可用于非登录场景的授权 — 比如邮箱验证链接、邀请注册链接
- API签名的时间戳差距默认15分钟 — 可根据网络延迟调整
Data Privacy
本技能不收集、存储或传输任何用户数据。所有代码示例仅供本地开发参考。
FAQ
What does the sa-token-api-security skill do?
Sa-Token API 安全防御技能。覆盖 API 参数签名(sa-token-sign)防篡改防重放(timestamp+nonce+sign四步演进)、API Key(sa-token-apikey)部分授权与Scope控制(可吊销/可限权)、临时Token(SaTempUtil内嵌核心包)短效链接邀请。 API签名支持多应用(多secret-key)模式和多种摘要算法(md5/sha256/sha512)。API Key支持多账号体系、数据库持久化模式。临时Token支持前缀裁剪、反向查询、JWT集成。 基础登录认证请先使用 sa-token 技能。
How do I install sa-token-api-security?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-api-security in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token-api-security/ (personal) or .claude/skills/sa-token-api-security/ (project).
Which AI agents can use sa-token-api-security?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token-api-security safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token-api-security?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 75 recorded installs.
More from full-stack-skills/java-skills
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合，基于阿里巴巴Java开发手册（嵩山版）。 涵盖7大维度：编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要：(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词：Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
mybatis-plus-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范（SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性）。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
mybatis-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
mapstruct-patterns
full-stack-skills/java-skills
MapStruct 最佳实践模式。从官方 Reference Guide 提炼，覆盖 Mapper 三种定义方式(接口/抽象类/default方法)、Spring 注入策略(CONSTRUCTOR推荐/SETTER解决循环依赖)、嵌套映射模式(显式子方法 dot notation 一次性配置)、@Qualifier @Named 的安全选择、Lombok 集成规则、@MappingComposition 谨慎使用。 纠正 LLM 最常见的错误：用反射 BeanUtils 而非编译期 MapStruct、嵌套映射全写在一个方法、不知 SETTER 解决循环依赖。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.