SuperAPI AI Directory
Partner中文AI newsFavorites
Skillssa-token-oauth2

sa-token-oauth2

Data & analytics

View repository

Updated 10-15 17:27

About this skill

Sa-Token OAuth2.0 Server

Based on sa-token-doc/oauth2/ All 17 documents. Basic authentication uses sa-token skill.

Capability Boundaries

✅ Strong Suits

  1. Authorization Code mode — Web applications with a backend, most commonly used, highest security
  2. Implicit mode — Pure frontend applications
  3. Password mode — Trusted clients (own app)
  4. Client Credentials mode — Service-to-service calls, no user authorization required
  5. Scope permission control — Custom Scope + Scope level division
  6. OIDC protocol — OpenID Connect identity layer
  7. OpenId/UnionId — User unique identifier generation and management
  8. Custom grant_type — Extended authorization types
  9. Custom login/authorization page — Customized frontend interface
  10. Annotation validation of Access-Token — @SaCheckAccessToken、@SaCheckClientToken

⚠️ Requirements

  1. Requires a JDK 8+ environment
  2. OAuth2-Server needs a network accessible by the Client
  3. Need to implement the SaOAuth2DataLoader interface to provide data

❌ Out of Scope

  1. Basic login/permission authentication → sa-token
  2. SSO single sign-on → sa-token-sso
  3. Microservice authentication → sa-token-micro

Four authorization modes

Mode Applicable scenario Description
Authorization Code Web applications with a backend Most commonly used, highest security
Implicit Pure frontend applications No longer recommended
Password Trusted clients Used by own app
Client Credentials Service-to-service calls No user authorization required

When to use which mode

  • Developing an open platform for third-party developers → Authorization Code mode, standard OAuth2 flow
  • Your own frontend-backend separated application → Password mode, simple and direct
  • API calls between microservices → Client Credentials mode, no user involvement required
  • Pure frontend application without a backend (no longer recommended) → Implicit mode

Workflow

Step 1. Introduce dependencies — Add sa-token-oauth2 dependency Step 2. Implement DataLoader — SaOAuth2DataLoaderImpl Load client and Scope data Step 3. Configure Server endpoints — Register authorize/token/validate/refresh endpoints Step 4. Configure OAuth2 parameters — Set Token validity period, authorization modes, etc. Step 5. Test the authorization flow — Use Authorization Code mode to verify the end-to-end flow Step 6. Security hardening before launch — Enable domain validation, configure callback whitelist

Reference documents

Topic File Source
Server setup + DataLoader references/oauth2-server.md oauth2-server、oauth2-apidoc
DataLoader + domain validation + custom references/oauth2-data-loader.md data-loader、check-domain
Scope permission customization and tiering references/oauth2-scope.md custom-scope、scope-level

FAQ

Q: What is the difference between OAuth2 and SSO? A: OAuth2 solves the authorization problem (third-party applications accessing user data), while SSO solves the authentication problem (unified login). Choose OAuth2 when third-party authorization is needed, and SSO when only unified login is needed. The two can also be used together.

Q: Which of the four authorization modes should be chosen? A: For web applications with a backend, choose the authorization code mode (the most secure). For your own app, choose the password mode. For service-to-service calls, choose the client credentials mode. The implicit mode is no longer recommended.

Q: How to customize Scope? A: Implement the SaOAuth2DataLoader.getScope() method, return the SaScopeObject object, where you can set the scope name, description, and whether it is selected by default.

Q: How to ensure the security of the OAuth2 service? A: 1) Configure is-check-domain: true to validate the callback domain; 2) Configure the allow-url whitelist; 3) Disable isAutoModein the production environment; 4) Use HTTPS.

Q: Is Token refresh supported? A: Supported.refresh-token-timeout defaults to 30 days; call the /oauth2/refresh interface to refresh.

Q: How to integrate OAuth2 with a separated frontend and backend? A: The frontend receives the code through URL parameters and calls the backend /oauth2/token interface to exchange it for an AccessToken, then saves it to local storage.

Gotchas

  1. You must implement SaOAuth2DataLoader — After the Server starts, data will not be loaded automatically; you need to implement the interface yourself
  2. allow-url must be configured — If the callback URL whitelist is not configured, authorization will fail
  3. Disable isAutoMode in the production environment — Automatic authorization confirmation mode is only for development and debugging
  4. The default AccessToken validity period is 2 hours — Can be set via access-token-timeout configuration
  5. Scope needs to be configured on both the DataLoader and ClientModel sides — Configuring only one side will not take effect
  6. The implicit mode is not recommended for production use — The AccessToken is directly exposed in the URL, which poses a security risk
  7. OIDC requires additional configuration of iss and idTokenTimeout — It cannot be used simply by enabling it by default
  8. If domain validation fails, an error will be returned — When configuring allow-domains , all legitimate clients must be included

Data Privacy

This skill does not collect, store, or transmit any user data. All code examples are for local development reference only.