{"record":{"id":"9d01d56d6d230571","repo":"paascloud/paascloud-master","slug":"error-9d01d5","errorCode":null,"errorMessage":"验证码不匹配","messagePattern":"验证码不匹配","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":400,"severity":"error","filePath":"paascloud-common/paascloud-security-core/src/main/java/com/paascloud/security/core/validate/code/impl/AbstractValidateCodeProcessor.java","lineNumber":150,"sourceCode":"\n\t\tString codeInRequest;\n\t\ttry {\n\t\t\tcodeInRequest = ServletRequestUtils.getStringParameter(request.getRequest(), codeType.getParamNameOnValidate());\n\t\t} catch (ServletRequestBindingException e) {\n\t\t\tthrow new ValidateCodeException(\"获取验证码的值失败\");\n\t\t}\n\n\t\tif (StringUtils.isBlank(codeInRequest)) {\n\t\t\tthrow new ValidateCodeException(codeType + \"验证码的值不能为空\");\n\t\t}\n\n\t\tif (codeInSession == null || codeInSession.isExpired()) {\n\t\t\tvalidateCodeRepository.remove(request, codeType);\n\t\t\tthrow new ValidateCodeException(codeType + \"验证码已过期\");\n\t\t}\n\n\t\tif (!StringUtils.equals(codeInSession.getCode(), codeInRequest)) {\n\t\t\tthrow new ValidateCodeException(codeType + \"验证码不匹配\");\n\t\t}\n\t}\n}\n","sourceCodeStart":132,"sourceCodeEnd":154,"githubUrl":"https://github.com/paascloud/paascloud-master/blob/781281a9503332ed3cef44ea618349d14230a127/paascloud-common/paascloud-security-core/src/main/java/com/paascloud/security/core/validate/code/impl/AbstractValidateCodeProcessor.java#L132-L154","documentation":"Fires in AbstractValidateCodeProcessor.check when the code submitted in the request is non-blank but does not string-equal the code stored in the session repository. The stored code exists and is unexpired (those cases raise earlier errors), but the user entered the wrong value, so validation fails and the login/form flow is rejected.","triggerScenarios":"Typing the code wrong; submitting a code generated for a different deviceId; reusing a stale code after a new one was generated (repository holds only the latest).","commonSituations":"User transposes digits from an SMS; frontend cached an old code; two browser tabs each generated codes and the second overwrote the first; deviceId header differs between generate and validate requests.","solutions":["Have the user re-enter or re-request the code","Verify the deviceId header is identical on generate and validate requests","Re-request the code if a newer one may have been generated","Catch ValidateCodeException and return a clear 'incorrect code' message with limited retries"],"exampleFix":"// before\ncurl -H \"deviceId:\" -d smsCode=111 /code/validate\ncurl -d smsCode=222 /auth/login\n// after\n// same deviceId on both calls, and use the latest code\ncurl -H \"deviceId:dev-1\" -d smsCode=123456 /code/check\ncurl -H \"deviceId:dev-1\" -d smsCode=123456 /auth/login","handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { processor.validate(request); } catch (ValidateCodeException e) { if (e.getMessage().contains(\"不匹配\")) { retryCount++; if (retryCount >= 5) lockAccount(); } }","preventionTips":["Auto-focus and numeric keypad for code input","Regenerate code on failure after N attempts","Ensure the same deviceId is used for generate and validate","Avoid multiple tabs generating competing codes"],"tags":["validation-code","mismatch","input-validation"],"backgroundTag":"verification-code-mismatch","analyzedSha":"781281a9503332ed3cef44ea618349d14230a127","analyzedAt":"2026-09-10T10:59:02.070Z","contentChangedAt":"2026-09-10T10:59:02.070Z","schemaVersion":2},"datasetVersion":"2026-09-16T04:17:20.429Z"}