{"record":{"id":"705550e0505a5c13","repo":"wuyouzhuguli/SpringAll","slug":"error-705550","errorCode":null,"errorMessage":"验证码不正确！","messagePattern":"验证码不正确！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":61,"sourceCode":"\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":43,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L43-L66","documentation":"Thrown by SmsCodeFilter.validateCode when the submitted smsCode does not case-insensitively equal the stored session code. Even when reached, the surrounding code is unreliable due to two source bugs: mobileInRequest is read from the wrong param (line 46) and the final removeAttribute (line 63) clears SESSION_KEY_IMAGE_CODE instead of the SMS key, so the consumed SMS code is never invalidated.","triggerScenarios":"User mistyped the SMS code; stale code submitted; or — due to the line 46 bug — the wrong session entry is read, producing a mismatch.","commonSituations":"Misread code; previously-requested code still entered after refresh; cross-contamination from the wrong session key caused by the mobile-param bug.","solutions":["Fix line 46 so the lookup uses the correct mobile parameter, restoring accurate session-key matching.","Have the user re-enter the exact 6-digit code from the latest SMS.","Re-request the SMS code and resubmit promptly.","Fix line 63 removeAttribute to clear SESSION_KEY_SMS_CODE + mobile after success."],"exampleFix":"// before\n// mismatch due to wrong session key from line-46 bug\n\n// after\nString mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"mobile\");\nsessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);","handlingStrategy":"validation","validationCode":"// client-side: require exact 6-digit smsCode before submit\nconst code = (form.get('smsCode') || '').trim();\nif (!/^\\d{6}$/.test(code)) { showError('请输入6位短信验证码'); return; }","typeGuard":null,"tryCatchPattern":"// AuthenticationFailureHandler: on mismatch, re-request SMS and retry.","preventionTips":["FIX line 46 (mobile param) so the correct session key is read.","Re-enter the exact code from the latest SMS.","FIX line 63 removeAttribute to invalidate the consumed SMS code."],"tags":["spring-security","sms","captcha","validation","bug","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}