{"record":{"id":"51e06e7446677f03","repo":"wuyouzhuguli/SpringAll","slug":"error-51e06e","errorCode":null,"errorMessage":"验证码不正确！","messagePattern":"验证码不正确！","errorType":"exception","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":58,"sourceCode":"        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":40,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L40-L65","documentation":"ValidateCodeException thrown by ValidateCodeFilter.validateCode() when the submitted imageCode does not match the session code, compared case-insensitively (StringUtils.equalsIgnoreCase). All prior checks (present, exists, not expired) have passed, so this is purely a value mismatch - a genuine wrong answer.","triggerScenarios":"POST to login with a present, non-expired imageCode whose value differs from the one rendered in the captcha image.","commonSituations":"User misread the image (common with ambiguous chars like 0/O, 1/l/I); stale browser autocomplete filled an old code; the displayed image was refreshed but the user typed the previous code; case differences (handled, but whitespace is not trimmed).","solutions":["Tell the user to re-enter the code exactly as shown, ignoring case.","Refresh the captcha image and try again if unsure.","Trim the submitted value before comparing to avoid whitespace mismatches.","Use a less ambiguous captcha character set in generation."],"exampleFix":"// before\nif (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n    throw new ValidateCodeException(\"验证码不正确！\");\n}\n\n// after (trim + clearer message)\nString clean = StringUtils.trim(codeInRequest);\nif (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), clean)) {\n    throw new ValidateCodeException(\"验证码不正确,请刷新后重试！\");\n}","handlingStrategy":"validation","validationCode":"// normalize user input before submit\nform.imageCode.value = form.imageCode.value.trim();\nif (!form.imageCode.value) { showError('请输入图形验证码'); return; }","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Trim and upper-case the captcha input consistently before comparison.","Use an unambiguous captcha character set to reduce misreads.","Offer a one-click refresh so users do not retry a stale, misread code."],"tags":["spring-security","captcha","validation","input-mismatch"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}