sa-token-micro
Sa-Token 微服务鉴权技能。覆盖 Same-Token 内部服务外网隔离机制、SpringCloud Gateway 网关统一鉴权(Reactor响应式)、Feign/Dubbo/gRPC 内部RPC调用鉴权、分布式Session会话方案(Redis Session中心/JWT无状态)、Reactor/WebFlux框架集成、SpringBoot3/4依赖适配。 当用户需要微服务架构下的服务间认证、网关Token转发与校验、内部服务外网隔离、分布式会话共享时使用。 基础登录认证请先使用 sa-token 技能。
- Installs
- 77
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-micro- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token-micro automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token 微服务鉴权
基于 sa-token-doc/micro/ 全部 4 个文档。基础认证使用 sa-token 技能。
Capability Boundaries
✅ Strong Suits
- Same-Token机制 — 内部服务外网隔离，防止绕过网关直接访问子服务
- 网关统一鉴权 — SpringCloud Gateway集中式登录+权限校验
- Reactor/WebFlux集成 — 响应式框架适配（SaReactorFilter）
- 分布式Session — 基于Redis的分布式会话共享
- Feign内部调用鉴权 — RPC调用时携带Same-Token
- Dubbo/gRPC集成 — 跨服务上下文传播
- Same-Token定时刷新 — 支持新旧Token双轨并行
⚠️ Requirements
- 所有服务需要共享同一个Redis（Same-Token依赖Redis）
- Gateway需要使用Reactor响应式依赖
- 子服务需要独立的Sa-Token依赖
❌ Out of Scope
- 基础登录/权限/注解鉴权 → sa-token
- SSO单点登录 → sa-token-sso
- OAuth2.0 → sa-token-oauth2
- 单体应用 → 直接使用 sa-token 即可
架构
客户端 → Gateway(校验登录+注入Same-Token) → 子服务(校验Same-Token)
↕ Feign(携带Same-Token)
其他子服务(校验Same-Token)
工作流
Step 1. 引入依赖 — Gateway用Reactor依赖，子服务用Servlet依赖 Step 2. 配置Redis — 所有服务连接到同一个Redis Step 3. Gateway统一鉴权 — SaReactorFilter集中校验登录和权限 Step 4. Gateway注入Same-Token — ForwardAuthFilter添加请求头 Step 5. 子服务校验 — SaServletFilter校验Same-Token Step 6. Feign/Dubbo集成 — RPC调用传递Same-Token Step 7. 定时刷新 — 定期刷新Same-Token以保证高可用
参考文档
| 文件 | 说明 | 来源 |
|---|---|---|
| gateway-auth.md | 网关统一鉴权+分布式Session | gateway-auth、dcs-session |
| same-token.md | Same-Token隔离+依赖引入 | same-token(277行)、import-intro |
FAQ
Q: Same-Token和OAuth2有什么区别？ A: Same-Token用于同源系统内部鉴权，简单高效。OAuth2用于开放平台第三方授权。内部用Same-Token，外部用OAuth2。
Q: Same-Token有效期多久？ A: 默认86400秒（1天），建议使用定时任务每5分钟刷新一次。刷新时旧Token作为次级Token保留，新旧其一都可通过。
Q: Gateway和子服务需要不同的依赖？
A: 是的。Gateway用 sa-token-reactor-spring-boot-starter（响应式），子服务用 sa-token-spring-boot-starter（Servlet）。
Q: 分布式Session怎么实现？
A: 只需引入 sa-token-redis-template 依赖并配置公共Redis地址，框架自动将会话数据存储到Redis，所有服务共享。
Q: Gateway鉴权和子服务鉴权怎么分工？ A: Gateway做统一登录校验+权限校验，子服务做Same-Token校验防止绕过网关直接访问。
Gotchas
- Gateway必须用Reactor依赖 — 用错Servlet依赖会报错
- 所有服务必须连同一个Redis — Same-Token依赖Redis共享
- Same-Token默认一天有效期 — 生产环境必须配置定时任务刷新
- Feign拦截器需要添加到FeignClient配置中 — 别忘了
configuration = FeignInterceptor.class - SaReactorFilter和SaServletFilter不可混用 — Gateway用Reactor，子服务用Servlet
- 子服务直接暴露在外网时必须配置Same-Token校验 — 否则可绕过网关直接访问
- Same-Token刷新时有短暂的双Token并行期 — 旧Token会被保留直到下次刷新
- 分布式Session的数据是序列化后存储的 — 存储的对象必须实现序列化接口
Data Privacy
本技能不收集、存储或传输任何用户数据。所有代码示例仅供本地开发参考。
FAQ
What does the sa-token-micro skill do?
Sa-Token 微服务鉴权技能。覆盖 Same-Token 内部服务外网隔离机制、SpringCloud Gateway 网关统一鉴权(Reactor响应式)、Feign/Dubbo/gRPC 内部RPC调用鉴权、分布式Session会话方案(Redis Session中心/JWT无状态)、Reactor/WebFlux框架集成、SpringBoot3/4依赖适配。 当用户需要微服务架构下的服务间认证、网关Token转发与校验、内部服务外网隔离、分布式会话共享时使用。 基础登录认证请先使用 sa-token 技能。
How do I install sa-token-micro?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-micro in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token-micro/ (personal) or .claude/skills/sa-token-micro/ (project).
Which AI agents can use sa-token-micro?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token-micro safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token-micro?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 77 recorded installs.
More from full-stack-skills/java-skills
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合，基于阿里巴巴Java开发手册（嵩山版）。 涵盖7大维度：编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要：(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词：Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
mybatis-plus-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范（SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性）。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
mybatis-patterns
full-stack-skills/java-skills
Open the skill to read its SKILL.md instructions.
redis-redisson-patterns
full-stack-skills/java-skills
Redis + Redisson 缓存与分布式锁技能。覆盖缓存Key命名规范、过期时间设置原则、RedisTemplate序列化选择(JSON vs JDK vs String)、Redisson分布式锁三大模式(watchDog/tryLock 有leaseTime/无leaseTime 决策)、缓存穿透(布隆/空值缓存)/击穿(互斥锁)/雪崩(随机TTL)防护、Caffeine vs Redis选择决策。 纠正 LLM：不设过期时间、StringRedisTemplate和RedisTemplate混用、Redisson锁不 try-finally unlock、看门狗在指定 leaseTime 时不生效。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.