{"record":{"id":"6f5230adaf9653da","repo":"wuyouzhuguli/SpringAll","slug":"error-6f5230","errorCode":null,"errorMessage":"验证码已过期！","messagePattern":"验证码已过期！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":58,"sourceCode":"        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":40,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L40-L66","documentation":"Thrown by SmsCodeFilter.validateCode when the session SmsCode exists but isExpire() returns true (default 60s from ValidateController.createSmsCode). BUG: the preceding removeAttribute call (line 57) removes SESSION_KEY_IMAGE_CODE instead of the SMS key, so it fails to clean up the actual SMS entry and silently removes an unrelated image-captcha entry.","triggerScenarios":"More than 60 seconds elapsed between GET /code/sms and POST /login/mobile; the user took too long to enter the code.","commonSituations":"Long think-time; short 60s SMS TTL; user re-requested code but stale entry lingered due to the wrong removeAttribute key.","solutions":["Submit the SMS code within the 60-second validity window.","Re-request the code via GET /code/sms?mobile=<number> when it expires, and resubmit.","Increase the SmsCode TTL in ValidateController.createSmsCode if needed.","Fix line 57 removeAttribute to use SESSION_KEY_SMS_CODE + mobileInRequest so the correct expired entry is cleared."],"exampleFix":"// before\nint expireIn = 60; // SmsCode(code, 60)\n\n// after\nreturn new SmsCode(code, 180);","handlingStrategy":"validation","validationCode":"// client-side countdown for the 60s SMS TTL\nlet ttl = 60;\nif (--ttl <= 0) { await requestSms(mobile); ttl = 60; }","typeGuard":null,"tryCatchPattern":"// AuthenticationFailureHandler: on '已过期', re-request SMS and prompt retry.","preventionTips":["Submit within the 60s window.","Re-request the code when it expires.","FIX line 57 removeAttribute to the SMS key.","Raise TTL if users need more time."],"tags":["spring-security","sms","captcha","session","expiry","validation","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}