{"record":{"id":"8fd7b3b11f6d7d33","repo":"wuyouzhuguli/SpringAll","slug":"error-8fd7b3","errorCode":null,"errorMessage":"验证码不存在！","messagePattern":"验证码不存在！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":54,"sourceCode":"            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":36,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L36-L66","documentation":"Thrown by SmsCodeFilter.validateCode when no SmsCode is found in session under key (SESSION_KEY_SMS_CODE + mobileInRequest). CRITICAL BUG in source: line 46 reads mobileInRequest from the 'smsCode' parameter, not 'mobile', so the session key is built from the SMS code value rather than the mobile number — which will almost never equal the key stored under SESSION_KEY_SMS_CODE+mobile. This error therefore fires on nearly every valid SMS login even when the code is correct.","triggerScenarios":"Any SMS login because the session key lookup uses the wrong parameter; or legitimately when /code/sms was never called for that mobile in the same session, or the session expired.","commonSituations":"The copy-paste bug on line 46 dominates; additionally, mobile param name mismatch, missing GET /code/sms?mobile=..., or session loss.","solutions":["Fix line 46: read mobileInRequest from the 'mobile' parameter, not 'smsCode': ServletRequestUtils.getStringParameter(req, \"mobile\").","Ensure the client calls GET /code/sms?mobile=<number> before POST /login/mobile to store the code under SESSION_KEY_SMS_CODE+mobile.","Confirm the submitted 'mobile' value exactly matches the one used when requesting the SMS code.","Preserve JSESSIONID across /code/sms and /login/mobile."],"exampleFix":"// before\nString mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n// after\nString mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"mobile\");","handlingStrategy":"validation","validationCode":"// client-side: request SMS code with mobile, then submit same mobile + smsCode\nawait fetch(`/code/sms?mobile=${encodeURIComponent(mobile)}`);\n// then POST with both mobile and smsCode","typeGuard":null,"tryCatchPattern":"// after fixing line 46, treat '不存在' as '请先获取验证码' in AuthenticationFailureHandler","preventionTips":["FIX line 46: read 'mobile' param, not 'smsCode'.","Always call /code/sms?mobile=... before /login/mobile.","Keep the mobile value identical across both calls.","Preserve JSESSIONID across the two requests."],"tags":["spring-security","sms","captcha","session","bug","validation","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}