{"record":{"id":"6f8c22339a00ea44","repo":"wuyouzhuguli/SpringAll","slug":"error-6f8c22","errorCode":null,"errorMessage":"验证码不正确！","messagePattern":"验证码不正确！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":61,"sourceCode":"\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":43,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L43-L66","documentation":"ValidateCodeException thrown when equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest) is false: the submitted SMS code does not match the one in session. Same wrong-key removal bug as 68 applies after this throw. In this project the SMS code is printed to the server console (ValidateController: '您的登录验证码为...') instead of being texted.","triggerScenarios":"User typed the wrong 6-digit code; the code in session belongs to a different mobile (compounded by the mobileInRequest bug); the code was read from the console but mistyped.","commonSituations":"Manual testing where the developer copies the console-printed code incorrectly; SMS delivery delay so the user resends and enters the older code; multiple /code/sms calls overwrote the session value.","solutions":["Copy the exact 6-digit code printed to the server console (or delivered by SMS) and resubmit.","Ensure only one GET /code/sms per mobile is outstanding to avoid session-value overwrite confusion.","After fixing the mobileInRequest bug (errors 67/68), confirm the comparison runs against the code stored for the correct mobile."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Sanity-check the 6-digit code before submit.\nconst code = form.get('smsCode');\nif (!/^\\d{6}$/.test(code || '')) { showFieldError('smsCode','请输入6位短信验证码'); return; }","typeGuard":null,"tryCatchPattern":"try { await smsLogin(); }\ncatch (e) { if (/不正确/.test(e.message)) { await resendSms(); } else handleError(e); }","preventionTips":["Avoid multiple /code/sms resends before submitting (they overwrite the session value).","After fixing the mobile-key bug, confirm the comparison targets the correct mobile's code.","Copy the console-printed code exactly when testing locally."],"tags":["sms","captcha","validation","spring-security"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}