sa-token-oauth2
Sa-Token OAuth2.0 服务端技能。覆盖四种授权模式：授权码模式(Authorization Code)、隐式模式(Implicit)、密码模式(Password)、客户端凭证模式(Client Credentials)。 完整 OAuth2-Server 搭建、SaOAuth2DataLoader 数据加载器、Scope 权限自定义与分级、OIDC 协议、OpenId/UnionId、自定义 granttype、自定义登录授权页、注解校验 Access-Token、与登录会话互通、Scope level 等级控制、自定义API路由。 当用户需要搭建OAuth2.0认证服务器、开发开放平台、实现第三方应用授权时使用。 基础登录认证请先使用 sa-token 技能。
- Installs
- 77
- Last 24h
- —
- Trending rank
- —
- Security
- Not audited
Install
Works with every agent the skills CLI supports.
npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-oauth2- 01
Install
Run the command in your project. The CLI asks which agents to install for.
- 02
Describe the task
Ask your agent for something this skill covers. It loads sa-token-oauth2 automatically when relevant.
- 03
Review the result
The agent follows the SKILL.md steps, scripts and references bundled with the skill.
SKILL.md
The instructions your agent reads when the skill is triggered.
Sa-Token OAuth2.0 服务端
基于 sa-token-doc/oauth2/ 全部 17 个文档。基础认证使用 sa-token 技能。
Capability Boundaries
✅ Strong Suits
- 授权码模式(Authorization Code) — 有后端的Web应用，最常用，安全性最高
- 隐式模式(Implicit) — 纯前端应用
- 密码模式(Password) — 信任的客户端（自家APP）
- 客户端凭证模式(Client Credentials) — 服务间调用，无需用户授权
- Scope权限控制 — 自定义Scope+Scope等级划分
- OIDC协议 — OpenID Connect身份层
- OpenId/UnionId — 用户唯一标识生成与管理
- 自定义grant_type — 扩展授权类型
- 自定义登录/授权页 — 定制化前端界面
- 注解校验Access-Token — @SaCheckAccessToken、@SaCheckClientToken
⚠️ Requirements
- 需要JDK 8+环境
- OAuth2-Server需要可被Client访问的网络
- 需实现 SaOAuth2DataLoader 接口提供数据
❌ Out of Scope
- 基础登录/权限认证 → sa-token
- SSO单点登录 → sa-token-sso
- 微服务鉴权 → sa-token-micro
四种授权模式
| 模式 | 适用场景 | 说明 |
|---|---|---|
| 授权码(Authorization Code) | 有后端的Web应用 | 最常用，安全性最高 |
| 隐式(Implicit) | 纯前端应用 | 已不推荐使用 |
| 密码(Password) | 信任的客户端 | 自家APP使用 |
| 客户端凭证(Client Credentials) | 服务间调用 | 无需用户授权 |
什么时候用哪种模式
- 开发开放平台，给第三方开发者使用 → 授权码模式，标准OAuth2流程
- 自己的前后端分离应用 → 密码模式，简单直接
- 微服务之间调用API → 客户端凭证模式，无需用户参与
- 纯前端无后端应用（已不推荐） → 隐式模式
工作流
Step 1. 引入依赖 — 添加 sa-token-oauth2 依赖
Step 2. 实现DataLoader — SaOAuth2DataLoaderImpl 加载客户端和Scope数据
Step 3. 配置Server端点 — 注册 authorize/token/validate/refresh 接口
Step 4. 配置OAuth2参数 — 设置Token有效期、授权模式等
Step 5. 测试授权流程 — 使用授权码模式验证端到端流程
Step 6. 上线前安全加固 — 开启域名校验、配置回调白名单
参考文档
| 主题 | 文件 | 来源 |
|---|---|---|
| Server搭建+DataLoader | references/oauth2-server.md | oauth2-server、oauth2-apidoc |
| DataLoader+域名校验+自定义 | references/oauth2-data-loader.md | data-loader、check-domain |
| Scope权限自定义与分级 | references/oauth2-scope.md | custom-scope、scope-level |
FAQ
Q: OAuth2和SSO有什么区别？ A: OAuth2解决授权问题（第三方应用访问用户数据），SSO解决认证问题（统一登录）。需要第三方授权选OAuth2，仅需统一登录选SSO。也可两者结合使用。
Q: 四种授权模式选哪种？ A: 有后端的Web应用选授权码模式（最安全）。自家APP选密码模式。服务间调用选客户端凭证模式。隐式模式已不推荐。
Q: 如何自定义Scope？
A: 实现 SaOAuth2DataLoader.getScope() 方法，返回 SaScopeObject 对象，可设置scope名称、描述、是否默认选中。
Q: 如何保证OAuth2服务安全？
A: 1) 配置 is-check-domain: true 校验回调域名；2) 配置 allow-url 白名单；3) 生产环境关闭 isAutoMode；4) 使用HTTPS。
Q: 支持刷新Token吗？
A: 支持。refresh-token-timeout 默认30天，调用 /oauth2/refresh 接口刷新。
Q: 前后端分离怎么对接OAuth2？
A: 前端通过URL参数接收code，调用后端 /oauth2/token 接口换取AccessToken，保存到本地存储。
Gotchas
- 必须实现 SaOAuth2DataLoader — Server启动后不会自动加载数据，需要自行实现接口
- allow-url 必须配置 — 不配置回调URL白名单会导致授权失败
- 生产环境关闭 isAutoMode — 自动确认授权模式仅用于开发调试
- AccessToken有效期默认2小时 — 可通过
access-token-timeout配置 - Scope需要在 DataLoader 和 ClientModel 两端配置 — 只配一端不会生效
- 隐式模式不推荐生产使用 — AccessToken直接暴露在URL中，有安全风险
- OIDC需要额外配置 iss 和 idTokenTimeout — 不是默认开启就能用
- 域名校验不通过会返回错误 — 配置
allow-domains时要包含所有合法客户端
Data Privacy
本技能不收集、存储或传输任何用户数据。所有代码示例仅供本地开发参考。
FAQ
What does the sa-token-oauth2 skill do?
Sa-Token OAuth2.0 服务端技能。覆盖四种授权模式：授权码模式(Authorization Code)、隐式模式(Implicit)、密码模式(Password)、客户端凭证模式(Client Credentials)。 完整 OAuth2-Server 搭建、SaOAuth2DataLoader 数据加载器、Scope 权限自定义与分级、OIDC 协议、OpenId/UnionId、自定义 granttype、自定义登录授权页、注解校验 Access-Token、与登录会话互通、Scope level 等级控制、自定义API路由。 当用户需要搭建OAuth2.0认证服务器、开发开放平台、实现第三方应用授权时使用。 基础登录认证请先使用 sa-token 技能。
How do I install sa-token-oauth2?
Run npx skills add https://github.com/full-stack-skills/java-skills --skill sa-token-oauth2 in your project. The skills CLI detects the agents you use and copies the skill into the right folder. For Claude Code you can also place the skill folder at ~/.claude/skills/sa-token-oauth2/ (personal) or .claude/skills/sa-token-oauth2/ (project).
Which AI agents can use sa-token-oauth2?
Any agent that supports the open Agent Skills format (a folder with a SKILL.md file), including Claude Code, Codex, Cursor, GitHub Copilot, Gemini CLI, Windsurf, Cline, OpenCode and more.
Is sa-token-oauth2 safe to install?
No partner security audit is available yet. Skills can run commands and scripts, so read the SKILL.md and any bundled files before installing.
Who maintains sa-token-oauth2?
It is published by full-stack-skills in full-stack-skills/java-skills. It has 77 recorded installs.
More from full-stack-skills/java-skills
mybatis-plus-patterns
full-stack-skills/java-skills
MyBatis-Plus 增强 ORM 技能。覆盖 LambdaQueryWrapper vs QueryWrapper选择(始终Lambda)、分页插件(PaginationInnerInterceptor)配置、乐观锁(@Version + OptimisticLockerInnerInterceptor)、逻辑删除(@TableLogic 全局/局部配置)、自动填充(@TableField fill + MetaObjectHandler)、ActiveRecord vs Mapper模式选择、防全表更新(BlockAttackInnerInterceptor)、通用PageQuery抽取。 当用户使用 MyBatis-Plus 进行数据库操作、配置分页乐观锁、选择查询方式时使用。 与 mybatis 技能互补：mybatis 侧重XML/ResultMap/SQL写法，mybatis-plus 侧重增强功能。
java-development-manual
full-stack-skills/java-skills
Java开发手册规约集合，基于阿里巴巴Java开发手册（嵩山版）。 涵盖7大维度：编程规约、异常日志、单元测试、安全规约、MySQL数据库、工程结构、设计规约。 当用户需要：(1) 编写或审查Java代码 (2) 检查命名/代码规范 (3) 处理异常和日志 (4) 编写单元测试 (5) 安全编码 (6) 数据库设计 (7) 工程架构设计时使用此skill。 触发词：Java规范、阿里规约、代码规范、开发手册、编程规约、异常处理、单元测试、安全、MySQL、工程结构、设计模式。
java-code-comments
full-stack-skills/java-skills
Provides comprehensive guidance for adding Java code comments following industry standards and best practices. This skill helps add class-level comments, method-level comments, and field-level comments to Java code. Use when the user wants to add comments to Java code, needs to document Java classes/methods/fields, wants to improve code documentation, or needs to generate JavaDoc comments. This skill covers Controller, Service, ServiceImpl, Mapper, Model, Entity, BO (Business Object), DTO, VO, and other common Java component types. The skill follows a systematic workflow: scan codebase, identify components, create todo list, and add comments in order (class comments → method comments → field comments).
mybatis-patterns
full-stack-skills/java-skills
MyBatis 核心 ORM 技能。覆盖 XML vs 注解 SQL选择、ResultMap复用(extends)、关联查询(association/collection join vs 嵌套select/N+1决策)、分页插件配置、和$的SQL注入防护、动态SQL(if/where/set/foreach/choose)最佳实践、columnPrefix解决同表多次JOIN。 当用户编写 MyBatis Mapper XML、处理关联查询、配置分页、防范SQL注入时使用。
java-conventions
full-stack-skills/java-skills
统一 Java 项目编码规范与注释规范（SLF4J+Lombok 日志、Bean Lombok 注解选择、判空 Objects/Optional、工具类优先级 Spring→Apache Commons→Hutool→Guava、复杂逻辑用设计模式/简单逻辑不拆分、Controller/Service/ServiceImpl/Mapper 注释一致性）。当需要“按 Java 规范重构/Review/补全注释/统一日志/统一工具类使用/补全 JavaDoc”时使用。
junit-mockito-patterns
full-stack-skills/java-skills
JUnit5 + Mockito 测试框架技能。覆盖 JUnit5 @ExtendWith替代@RunWith、Mockito @Mock/@InjectMocks规则、测试隔离原则(FIRST)、@SpringBootTest何时用何时不用(@WebMvcTest/@DataJpaTest切片测试)、BDDMockito given/willReturn风格、ArgumentCaptor参数捕获、verify行为验证、@ParameterizedTest参数化测试。 当用户编写 Java 单元测试/集成测试、Mock外部依赖时需要此技能。
Popular backend & apis skills
find-skills
vercel-labs/skills
Helps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skill should be used when the user is looking for functionality that might exist as an installable skill.
entra-app-registration
microsoft/azure-skills
Guides Microsoft Entra ID app registration, OAuth 2.0 authentication, and MSAL integration. USE FOR: create app registration, register Azure AD app, configure OAuth, set up authentication, add API permissions, generate service principal, MSAL example, console app auth, Entra ID setup, Azure AD authentication. DO NOT USE FOR: Key Vault secrets (use azure-keyvault-expiration-audit), general Azure resource security guidance.
google-agents-cli-adk-code
google/agents-cli
This skill should be used when the user wants to "write agent code", "build an agent with ADK", "add a tool", "create a callback", "define an agent", "use state management" — in a project that needs ADK (Agent Development Kit) API patterns and code examples. It provides a quick reference for agent types, tool definitions, orchestration patterns, callbacks, state management, the graph Workflow API, and reference recipes to study. Do NOT use for scaffolding (use google-agents-cli-scaffold) or deployment (use google-agents-cli-deploy).
embedded-captions
heygen-com/hyperframes
Add captions or subtitles to an existing single-subject talking-head video without editing the footage. Use for plain verbatim captions, cinematic captions embedded behind the subject, VFX captions, “炸/特效/酷炫字幕,” or a named identity from the 35-style catalog. Route by visual identity, not by backend engine. The quiet anchor rail is the default; embed every word only when the user explicitly wants a fully cinematic treatment. The workflow runs locally end to end, including transcription and subject matting; split multi-shot footage before applying it.
entra-agent-id
microsoft/azure-skills
Provision Microsoft Entra Agent Identity Blueprints, BlueprintPrincipals, and per-instance Agent Identities via Microsoft Graph, and configure OAuth 2.0 token exchange (fmipath, OBO, cross-tenant) including the Microsoft Entra SDK for AgentID sidecar. USE FOR: Agent Identity Blueprint, BlueprintPrincipal, agent OAuth, fmipath token exchange, agent OBO, Workload Identity Federation for agents, polyglot agent auth, Microsoft.Identity.Web.AgentIdentities. DO NOT USE FOR: standard Entra app registration (use entra-app-registration), Microsoft Foundry agent authoring (use microsoft-foundry).
neon
neondatabase/agent-skills
Overview of Neon, a complete set of cloud backend primitives around Lakebase Postgres: Auth, Object Storage, Functions, the AI Gateway, and Realtime. Start here to choose Neon for undecided login, files, APIs, and LLM calls, set up the CLI or MCP server, and follow the branch-first workflow. Use when building an app or backend on Neon, or when "Neon" or "Lakebase Postgres" is mentioned. Child skill neon-postgres wins for an existing DATABASEURL, SQL, schema, inspect, or search. Child skill neon-auth wins for login, users, sessions, identity routing, and Managed Better Auth setup. Child skill neon-realtime wins for live queries in reactive apps and agents. Also use for object storage, S3, buckets, serverless functions, function triggers, cron, AI gateway, LLM calls, realtime, logs, Loki, Grafana, observability, postgres, database, backend, Claimable Neon, neon.new, or a no-signup database.