Why Sa-Token Is the Simplest Java Permission Framework for SpringBoot

What is Sa-Token?

Sa-Token is a lightweight Java permission authentication framework that supports login authentication, permission checks, session management, single sign‑on (SSO), OAuth2.0, micro‑service gateway authentication, and many other features.

Sa-Token mainly solves login authentication, permission authentication, session, SSO, OAuth2.0, and micro‑service gateway authentication.

Simple API Example

Login and check login can be done with two lines of code:

// Write the current session's account id when logging in
StpUtil.login(10001);

// Check login status; throws NotLoginException if not logged in
StpUtil.checkLogin();

Permission Annotation Example

@SaCheckPermission("user:add")
@RequestMapping("/user/insert")
public String insert(SysUser user) {
    // ...
    return "用户增加";
}

Logout Example

// Force logout the session with account id 10001
StpUtil.logoutByLoginId(10001);

Feature Overview

Login authentication – single‑device, multi‑device, exclusive login, remember‑me

Permission & role authentication, session secondary authentication

Distributed session with Redis, JWT integration

Gateway authentication for common gateways (Gateway, ShenYu, Zuul)

SSO, OAuth2.0, basic auth, token generation, account banning, temporary token, impersonation, and many more

Dependency

<!-- Sa-Token permission authentication -->
<dependency>
    <groupId>cn.dev33</groupId>
    <artifactId>sa-token-spring-boot-starter</artifactId>
    <version>1.26.0</version>
</dependency>

Configuration (application.yml)

server:
  port: 8081

sa-token:
  token-name: satoken
  timeout: 2592000
  activity-timeout: -1
  is-concurrent: true
  is-share: false
  token-style: uuid
  is-log: false

Quick Demo

@SpringBootApplication
public class SaTokenDemoApplication {
    public static void main(String[] args) throws JsonProcessingException {
        SpringApplication.run(SaTokenDemoApplication.class, args);
        System.out.println("启动成功：Sa-Token配置如下：" + SaManager.getConfig());
    }
}

@RestController
@RequestMapping("/user/")
public class UserController {

    // Simulated login
    @RequestMapping("doLogin")
    public String doLogin(String username, String password) {
        if ("zhang".equals(username) && "123456".equals(password)) {
            StpUtil.login(10001);
            return "登录成功";
        }
        return "登录失败";
    }

    // Check login status
    @RequestMapping("isLogin")
    public String isLogin() {
        return "当前会话是否登录：" + StpUtil.isLogin();
    }
}