补充 alg 白名单校验(仅允许 HS256),parseToken 与 invalidateToken 增加签名校验
Introduction
youlai-boot is an enterprise-grade permission management backend built on Spring Boot. It ships with the frontend vue3-element-admin and the mobile app youlai-app, and is one of 7 language implementations (Java / Node.js / Go / Python / PHP / C# / Rust) that share the same API specification and database schema. It is suitable for learning, reference, and secondary development of enterprise admin systems.
Core Features
-
🔐 Security — Spring Security + JWT/Redis dual-session token model, token renewal, multi-device mutual exclusion
-
🛡️ Fine-grained permissions — 5-level RBAC: data → menu → button → API → field
-
⚡ Code generator — one-click generation of full-stack CRUD code
-
📦 Complete modules — users, roles, menus, departments, dictionaries, files (OSS/RustFS/local), scheduled tasks, message center, operation logs
-
🔀 Workflow — Flowable approval flows: online BPMN design, conditional gateways, role-based approval, rejection & rollback
-
🌐 Multi-tenant SaaS — data isolation + tenant config, with a standalone youlai-boot-tenant edition
-
🔌 Real-time communication — SSE push: online user count, dictionary sync, notification broadcast
System Preview
PC
![]() |
![]() |
![]() |
![]() |
![]() |
![]() |
Mobile
![]() |
![]() |
![]() |
![]() |
Quick Start
Requirements: JDK 17+ · MySQL 8.0+ · Redis 6.0+
-
Clone the project:
git clone https://gitee.com/youlaiorg/youlai-boot.git -
Import the database:
# Base schema (required) sql/youlai-admin.sql # Optional extensions: safe to skip, run after the base schema sql/extensions/dynamic-form.sql # Dynamic Form sql/extensions/workflow.sql # Workflow (Flowable demo processes & demo accounts, not engine tables) -
Adjust config (optional, a read-only online data source is configured by default):
src/main/resources/application-dev.yml -
Start the service:
Option 1: Run in IDEA (recommended) Open the project in IDEA, wait for Maven dependencies to download, then run the application class
YouLaiBootApplication.Option 2: Command line
mvn spring-boot:runOnce started, visit http://localhost:8000/doc.html. If the API docs open, the backend is running properly.
-
Start the frontend (optional): For a visual admin UI, start the companion frontend vue3-element-admin, visit http://localhost:3000, and log in with
admin/123456.
For more details, see the official docs: Quick Start · Deployment Guide
Directory Structure
youlai-boot/
├── docs/ # Docs and image assets
├── sql/ # Database init scripts
├── src/ # Source code
│ ├── auth/ # Auth module
│ │ ├── password/ # Username/password login (with captcha)
│ │ ├── sms/ # SMS verification code login
│ │ ├── qrcode/ # QR code login
│ │ ├── wxma/ # WeChat Mini Program login
│ │ └── session/ # Session management (logout / token renewal)
│ ├── codegen/ # Code generator
│ ├── common/ # Common module (constants/enums/exceptions/response/utils)
│ ├── config/ # Configuration (Security/Redis/MyBatis/API docs/CORS/scheduling etc.)
│ ├── framework/ # Infrastructure layer
│ │ ├── mybatis/ # MyBatis-Plus config
│ │ ├── security/ # Spring Security
│ │ │ ├── config/ # Security config and properties
│ │ │ ├── filter/ # Token authentication filter
│ │ │ ├── handler/ # Authentication / authorization failure handlers
│ │ │ ├── model/ # Security model (SecurityUser / token / data scope)
│ │ │ ├── port/ # Auth & permission ports (implemented by system)
│ │ │ ├── service/ # User details and permission service
│ │ │ ├── token/ # Token management (JWT / Redis dual mode)
│ │ │ └── util/ # Security utilities
│ │ └── web/ # Web layer (global exception/CORS/rate limit)
│ ├── module/ # Business extension modules
│ │ ├── form/ # Dynamic Form
│ │ └── workflow/ # Workflow
│ ├── support/ # Capability services
│ │ ├── file/ # File storage (RustFS/Alibaba Cloud OSS/local)
│ │ ├── mail/ # Email service
│ │ ├── sms/ # SMS service
│ │ └── sse/ # SSE push
│ └── system/ # System business (user/role/menu/dept/dict etc.)
├── docker-compose.yml # One-click middleware orchestration (MySQL/Redis/RustFS/Xxl-Job)
└── pom.xml # Maven dependency management
Ecosystem
Frontend
| Project | Stack | Description | Status |
|---|---|---|---|
| vue3-element-admin | Vue 3 + Element Plus | PC admin frontend (recommended) | ✅️ |
| youlai-app | Vue 3 + UniApp | Mobile App | ✅️ |
Backend
| Project | Stack | Description | Status |
|---|---|---|---|
| youlai-boot | Spring Boot + MyBatis-Plus | Java (recommended) | ✅️ |
| youlai-nest | NestJS + TypeORM | Node.js | ✅️ |
| youlai-gin | Go + Gorm | Go | ✅️ |
| youlai-django | Django + DRF | Python | ✅️ |
| youlai-fastapi | FastAPI + SQLAlchemy | Python | ✅️ |
| youlai-think | ThinkPHP + ThinkORM | PHP | ✅️ |
| youlai-aspnet | ASP.NET Core + EF Core | C# | ✅️ |
| youlai-axum | Axum + SeaORM | Rust | ✅️ |
| youlai-laravel | Laravel + Eloquent | PHP | ❌️ |
The nine backends share the same RESTful API specification and database schema, so the frontend can switch seamlessly.
Derived Editions
| Project | Based on | Type | Description | Status |
|---|---|---|---|---|
| youlai-boot-tenant | youlai-boot | Standalone repo | Multi-tenant SaaS with tenant isolation & config | ✅️ |
| youlai-boot-flex | youlai-boot | Standalone repo | Built on MyBatis-Flex | ✅️ |
| youlai-boot (db-pg) | youlai-boot | Branch | PostgreSQL database branch | ✅️ |
| youlai-boot (multi-module) | youlai-boot | Branch | Multi-module project split | ✅️ |
| youlai-nest (multi-tenant) | youlai-nest | Branch | Multi-tenant SaaS with tenant isolation & config | ✅️ |
| youlai-boot (spring-boot-3) | youlai-boot | Branch | Spring Boot 3 compatible branch | ❌️ |
Optional Extensions
Workflow (disabled by default)
Two steps to enable:
-
Import the demo data (demo processes & demo accounts):
sql/extensions/workflow.sqlThe ACT_* engine tables do not need to be imported — Flowable creates them automatically on startup (existing tables are left untouched).
-
Enable it in
application-{profile}.yml:workflow: enabled: trueThe Flowable engine switches (process / idm / eventregistry) follow
workflow.enabledvia placeholders in the sameapplication-{profile}.yml, no extra maintenance needed.
Multi-tenant
For tenant isolation and tenant configuration, use the standalone repo youlai-boot-tenant.
License & Support
This project is open-sourced under the Apache License 2.0 and free for commercial use. Feel free to submit issues or feedback, and pull requests are always welcome.
For technical support, business cooperation, secondary development, project customization, or private deployment, contact the author on WeChat (QR codes below).
![]() Official WeChat Account |
![]() Mini Program |
![]() Add author on WeChat |
Technical discussion · Feedback · Business cooperation













