// the take
XXL-SSO is a Java/Spring single-sign-on framework from the xxl-job author, supporting three login modes: cookie-based web SSO for same-domain monoliths, a CAS-style ticket flow for cross-domain enterprise systems, and a token-based 'Native' mode for mobile/frontend-separated clients. It's aimed at teams that want to bolt SSO onto an existing Spring Boot stack without standing up a full IAM product.
The LoginStore abstraction (local cache vs Redis) cleanly separates session persistence from auth logic, so swapping storage backends doesn't touch the filter/interceptor code. It covers Servlet filters, Spring MVC interceptors, and WebFlux reactive filters for the same auth flow, which is more complete reactive support than most Chinese open-source auth projects bother with. The three login modes map to real deployment shapes (monolith, cross-domain enterprise, mobile/SPA) rather than forcing one architecture on everyone.
It's GPLv3, which is a real adoption blocker for companies that want to embed it in proprietary backends rather than run it as a standalone service. There's no OAuth2/OIDC/SAML support — this is a bespoke ticket/token protocol, so you can't federate with Okta, Auth0, or Google as either an SP or IdP without writing a bridge yourself. Test coverage is thin for a security-critical component: a handful of test classes (token helper, login store, Jedis) is not enough confidence for something handling session and credential logic. Redis integration goes through raw Jedis rather than a maintained client like Lettuce, and the 'remember me' / token expiry logic is hand-rolled rather than built on a vetted session library, which raises the bar for a security audit before production use.
We read the README, the directory tree and a key source file in October 2026. Nobody pays to be listed. How we judge →