{"record":{"id":"3e673ca9bd9df465","repo":"wuyouzhuguli/SpringAll","slug":"error-3e673c","errorCode":null,"errorMessage":"验证码已过期！","messagePattern":"验证码已过期！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":55,"sourceCode":"                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":37,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L37-L65","documentation":"Thrown when ImageCode.isExpire() is true: LocalDateTime.now() is after the code's expireTime. ValidateController creates the code with a 60-second lifetime (expireIn=60). The filter removes the session attribute before throwing, so the code is single-use after expiry.","triggerScenarios":"More than 60 seconds elapsed between GET /code/image and the login POST; the user lingered on the form or typed slowly; client clock vs the generated code's plusSeconds(60) window was exceeded.","commonSituations":"Default 60s expiry is too short for slow users; user refreshed only the form (not the image) and submitted a stale code; debugging paused between fetch and submit.","solutions":["Refresh the captcha image (GET /code/image) and resubmit a fresh code within 60 seconds.","Increase expireIn in ValidateController.createImageCode (and the matching SmsCode lifetime) if users need more time.","On the frontend, auto-refresh the captcha image when the user focuses the login form or after a failure."],"exampleFix":"// before (ValidateController.createImageCode)\n// int expireIn = 60; // 验证码有效时间 60s\n\n// after\nint expireIn = 300; // extend to 5 minutes","handlingStrategy":"retry","validationCode":"// Track when the captcha was fetched; refresh if older than 50s (TTL is 60s).\nlet captchaFetchedAt = 0;\nasync function ensureFreshCaptcha() {\n  if (Date.now() - captchaFetchedAt > 50_000) { await refreshCaptcha(); }\n}","typeGuard":null,"tryCatchPattern":"try { await login(); }\ncatch (e) {\n  if (/已过期/.test(e.message)) { await refreshCaptcha(); /* user re-enters */ }\n  else handleError(e);\n}","preventionTips":["Show a countdown to the user based on the 60s TTL.","Auto-refresh the image when it is about to expire.","Raise expireIn in ValidateController if users need more time."],"tags":["captcha","expiry","session","spring-security"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}