{"record":{"id":"960fdfa8711a5679","repo":"wuyouzhuguli/SpringAll","slug":"error-960fdf","errorCode":null,"errorMessage":"验证码已过期！","messagePattern":"验证码已过期！","errorType":"exception","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":55,"sourceCode":"                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":37,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L37-L65","documentation":"ValidateCodeException thrown by ValidateCodeFilter.validateCode() when the session ImageCode reports it has expired (codeInSession.isExpire()). The filter removes the stale session attribute before throwing, so the user must obtain a fresh captcha. Expire is computed from the code's creation time vs. a configured TTL.","triggerScenarios":"POST to login with a non-empty, present imageCode whose age exceeds the configured expireIn (often 60 seconds in these demos).","commonSituations":"User left the login page open too long before submitting; expireIn is set very short; slow typing or a distraction; captcha generated, then a retry long after.","solutions":["Refresh the captcha image and resubmit promptly.","Increase the captcha expireIn (seconds) in the code-generation configuration.","Regenerate the image automatically on focus/submit when it is stale.","Show a countdown to the user so they know the code's lifetime."],"exampleFix":"// before\n// validateConfig with short TTL\nimageCode.setExpireTime(LocalDateTime.now().plusSeconds(30));\n\n// after\nimageCode.setExpireTime(LocalDateTime.now().plusSeconds(180));","handlingStrategy":"retry","validationCode":"// client-side: refresh the captcha and track its lifetime\nfunction refreshCaptcha() {\n    document.getElementById('captchaImg').src = '/code/image?t=' + Date.now();\n    captchaGeneratedAt = Date.now();\n}\n// if older than the configured TTL, refresh before submit\nif (Date.now() - captchaGeneratedAt > TTL_MS) refreshCaptcha();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Refresh the captcha image immediately before submitting if any time has passed.","Set expireIn long enough for realistic user input.","Show a countdown so users submit within the code's lifetime."],"tags":["spring-security","captcha","expiry","validation"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}