{"record":{"id":"3561afeb520bdc49","repo":"wuyouzhuguli/SpringAll","slug":"error-3561af","errorCode":null,"errorMessage":"验证码已过期！","messagePattern":"验证码已过期！","errorType":"exception","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":58,"sourceCode":"        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":40,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L40-L66","documentation":"ValidateCodeException thrown by SmsCodeFilter.validateCode() when the session SmsCode is present but expired (isExpire() true). NOTE: the expiry-cleanup path has a copy-paste defect - line 57 removes ValidateController.SESSION_KEY_IMAGE_CODE (the image-captcha key) instead of SESSION_KEY_SMS_CODE + mobileInRequest, so it neither clears the expired SMS code nor leaves the image session intact. Combined with the line-46 bug, the lookup key itself is often wrong.","triggerScenarios":"POST to /login/mobile with an SMS code whose age exceeds the configured expireIn; effectively reachable only after the line-46 mobile bug is fixed so the correct session key is consulted.","commonSituations":"User let the SMS code expire before submitting; expireIn configured too short; the wrong session attribute is being cleared (line 57 bug), leaving stale codes; mobile-key bug masks this branch entirely.","solutions":["Fix line 57 to remove ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest, not SESSION_KEY_IMAGE_CODE.","Also fix line 46 so mobileInRequest is read from the 'mobile' parameter.","Refresh the SMS code and resubmit within the TTL.","Increase expireIn if legitimate users cannot submit in time."],"exampleFix":"// before (line 57)\nsessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n// after\nsessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);","handlingStrategy":"retry","validationCode":"// client-side: refresh the SMS code and track its lifetime\nasync function refreshSmsCode(mobile) {\n    await fetch('/code/sms?mobile=' + encodeURIComponent(mobile), { credentials: 'same-origin' });\n    smsGeneratedAt = Date.now();\n}\nif (Date.now() - smsGeneratedAt > SMS_TTL_MS) await refreshSmsCode(mobile);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Fix SmsCodeFilter line 57 to remove SESSION_KEY_SMS_CODE + mobileInRequest, not the image-captcha key.","Also fix line 46 so the correct mobile is used to build the session key.","Refresh the SMS code and resubmit within its TTL."],"tags":["spring-security","sms-code","captcha","expiry","bug"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}