sa-token

Sa-Token is a lightweight Java authentication framework maintained by the dromara community, open-sourced under the Apache-2.0 license, with the current version v1.46.0, supporting JDK 8 to 25. The project is positioned as a 'one-stop' authentication solution, with core modules including login authentication, permission authentication, single sign-on (SSO), OAuth2.0, and microservice authentication. Regarding login authentication, the framework completes session login and validation through static calls, for example, StpUtil.login(accountId) to log in, StpUtil.checkLogin() to check login status, throwing NotLoginException when not logged in. Permission authentication supports two methods: annotation-based and route interception. Annotations such as @SaCheckPermission("user:add") separate authentication from business code; route interception uses SaInterceptor and SaRouter.match to divide permissions by path modules. The framework covers many features, including those listed in the README: single/multi-terminal login, mutual exclusion on the same terminal, remember-me mode, second-level authentication, kick-out offline (by account id or token value), account ban, temporary identity switching, impersonating other accounts, session query, global listeners and global filters, multi-account system authentication, HTTP Basic/Digest authentication, password encryption tools, temporary tokens, independent Redis, automatic renewal, tag dialects (Thymeleaf, beetl), etc. The persistence layer can integrate Redis to avoid data loss after restart, and supports authentication for no-cookie terminals such as APP and mini-programs in front-end/back-end separation scenarios. The SSO module provides three modes: Mode 1 is suitable for same-domain front-end and same Redis back-end, syncing sessions through shared cookies; Mode 2 is suitable for different-domain front-end but same Redis back-end, propagating sessions through URL redirect; Mode 3 is suitable for different-domain front-end and different Redis back-end, obtaining sessions by validating tickets through HTTP requests. The project also provides a NoSdk mode example and sso-server interface documentation for non-Java project integration, and includes security measures such as domain validation, ticket validation, and parameter signature validation. The OAuth2 module supports four authorization modes: authorization code, implicit, password, and client credentials. Additionally, the framework provides JWT integration (three modes), RPC call authentication and state passing (Dubbo, gRPC, etc.), API Key secret authorization, API parameter signing (anti-tampering, anti-replay), and other capabilities. In terms of integration, besides SpringBoot 2, it also provides integration packages for frameworks such as SpringBoot 3/4, Solon, and JFinal, and adapts to gateway routing interception authentication for Gateway, ShenYu, Zuul, etc. The project includes more than 60 independent examples covering scenarios such as login authentication, permission authentication, SSO, OAuth2, microservice authentication, JWT, parameter signing, and provides community links for multi-language implementations (Rust, Go, NodeJS, PHP). The documentation is primarily in Chinese, with versions also available in Traditional Chinese, English, Japanese, Korean, and Russian. The README lists several integration cases, such as Snowy, RuoYi-Vue-Plus, Smart-Admin, Chengdan, Dengdeng, Shiyi Blog, etc., and mentions community honors like Gitee GVP and GitCode G-Star.