{"record":{"id":"24b9eb55eba60820","repo":"wuyouzhuguli/SpringAll","slug":"error-24b9eb","errorCode":null,"errorMessage":"验证码不存在！","messagePattern":"验证码不存在！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":54,"sourceCode":"            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":36,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L36-L66","documentation":"ValidateCodeException thrown when the SmsCode looked up from session under SESSION_KEY_SMS_CODE + mobileInRequest is null. IMPORTANT BUG: SmsCodeFilter (project 61) reads mobileInRequest from the 'smsCode' parameter (getStringParameter(..., \"smsCode\")) instead of 'mobile', so the session key becomes SESSION_KEY_SMS_CODE + <the sms code value>, which never matches the key ValidateController stored under (SESSION_KEY_SMS_CODE + mobile). This error is therefore triggered even with a valid mobile and code.","triggerScenarios":"Any /login/mobile request, because the lookup key is built from the wrong parameter. Also genuinely triggered when the SMS code was never created (no prior GET /code/sms?mobile=...) or the session expired.","commonSituations":"Always-on bug in this sample project; developers copying this filter verbatim hit '验证码不存在' on every SMS login; session cookie not shared between /code/sms and /login/mobile.","solutions":["Fix the copy-paste bug: read 'mobile' for mobileInRequest so the session key matches ValidateController's storage key.","After the fix, ensure GET /code/sms?mobile=<num> was called in the same session before login.","Share the JSESSIONID cookie across both requests; in clusters use Spring Session."],"exampleFix":"// before\n// String mobileInRequest = ServletRequestUtils.getStringParameter(req, \"smsCode\");\n\n// after\nString mobileInRequest = ServletRequestUtils.getStringParameter(req, \"mobile\");","handlingStrategy":"try-catch","validationCode":"// This is a server-side bug; client cannot fully avoid it. After patching the filter,\n// ensure GET /code/sms?mobile=<num> ran in the same session before login.\nawait fetch(`/code/sms?mobile=${mobile}`, { credentials:'same-origin' });","typeGuard":null,"tryCatchPattern":"// Patch the filter first, then this becomes a normal 'generate-then-login' flow.\n// Server fix:\n// String mobileInRequest = ServletRequestUtils.getStringParameter(req, \"mobile\");\ntry { await smsLogin(); } catch (e) { if (/不存在/.test(e.message)) await resendSms(); }","preventionTips":["Fix the copy-paste bug: read 'mobile' for the mobile param so the session key matches ValidateController.","Ensure GET /code/sms?mobile=... is called before login in the same session.","Share JSESSIONID across both requests; use Spring Session in clusters.","Add a unit test asserting the lookup key equals SESSION_KEY_SMS_CODE + mobile."],"tags":["spring-security","sms","captcha","session","bug"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}