{"record":{"id":"0b32f6ef3c0c1834","repo":"wuyouzhuguli/SpringAll","slug":"error-0b32f6","errorCode":null,"errorMessage":"验证码不能为空！","messagePattern":"验证码不能为空！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":51,"sourceCode":"                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), \"post\")) {\n            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":33,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L33-L66","documentation":"Thrown by SmsCodeFilter.validateCode when the POST /login/mobile request omits a blank/absent 'smsCode' parameter. First validation gate of the SMS-captcha filter. Raised as ValidateCodeException and routed to AuthenticationFailureHandler. NOTE: line 46 has a copy-paste bug — mobileInRequest also reads the 'smsCode' param instead of 'mobile', but that does not affect this particular blank-check.","triggerScenarios":"A POST /login/mobile submission that omits the smsCode field, sends it empty, or names it differently. The filter runs only for requestURI '/login/mobile' and method POST.","commonSituations":"Front-end field named 'smsCode' missing from the payload; AJAX call forgets to include the typed code; field disabled.","solutions":["Include a parameter literally named 'smsCode' in the POST /login/mobile body.","Verify the front-end <input name=\"smsCode\"> matches the backend parameter.","Ensure the SMS-login flow collects the code from the user and appends it.","Confirm the filter only intercepts /login/mobile POST."],"exampleFix":"// before\nfetch('/login/mobile', { method:'POST', body:new URLSearchParams({mobile:'13800000000'}) });\n\n// after\nfetch('/login/mobile', { method:'POST', body:new URLSearchParams({mobile:'13800000000', smsCode:'123456'}) });","handlingStrategy":"validation","validationCode":"// client-side: ensure smsCode present before submit\nconst code = form.get('smsCode');\nif (!code || !code.trim()) { showError('请输入短信验证码'); return; }","typeGuard":null,"tryCatchPattern":"// SmsCodeFilter routes to AuthenticationFailureHandler; surface the message.","preventionTips":["Standardize the smsCode field name.","Disable submit until the code field is filled.","Confirm the filter only intercepts /login/mobile."],"tags":["spring-security","sms","captcha","validation","filter","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}