{"record":{"id":"836c5dd830f66710","repo":"wuyouzhuguli/SpringAll","slug":"error-836c5d","errorCode":null,"errorMessage":"验证码不存在！","messagePattern":"验证码不存在！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":51,"sourceCode":"            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":33,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L33-L65","documentation":"Thrown by ValidateCodeFilter.validateCode when the session contains no ImageCode under key ValidateController.SESSION_KEY_IMAGE_CODE (\"SESSION_KEY_IMAGE_CODE\"). It means the server never generated/stored a captcha for this session, or the session was lost. Raised as a ValidateCodeException and routed to AuthenticationFailureHandler.","triggerScenarios":"A POST /login arrives without a prior GET /code/image in the same JSESSIONID; the user opened the login page in a fresh tab/cookieless context; the session expired between fetching the image and submitting; or the image endpoint failed so nothing was stored.","commonSituations":"Client does not call /code/image before submitting; browser cookies blocked so each request is a new session; reverse proxy/load balancer without sticky sessions; session store flushed on redeploy.","solutions":["Guarantee the login page always loads GET /code/image (which stores ImageCode in session) before the user submits /login.","Confirm JSESSIONID is preserved across the image fetch and the login POST (same-origin, cookies enabled).","Check the createCode path in ValidateController actually runs and stores under SESSION_KEY_IMAGE_CODE.","Enable sticky sessions or a shared session store behind a load balancer."],"exampleFix":"// before\n// user submits /login directly without loading the captcha image\n\n// after\n// page onload:\nfetch('/code/image').then(() => { /* enable submit */ });","handlingStrategy":"validation","validationCode":"// client-side: load captcha image first, then enable login\nfetch('/code/image').then(() => { document.getElementById('submit').disabled = false; });","typeGuard":null,"tryCatchPattern":"// rely on AuthenticationFailureHandler; treat missing-session as '请先获取验证码'","preventionTips":["Always fetch /code/image on page load.","Keep JSESSIONID consistent (same-origin, cookies on).","Use sticky sessions behind a load balancer."],"tags":["spring-security","captcha","session","validation","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}