{"record":{"id":"a4be01ba888ac78c","repo":"wuyouzhuguli/SpringAll","slug":"error-a4be01","errorCode":null,"errorMessage":"验证码已过期！","messagePattern":"验证码已过期！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":58,"sourceCode":"        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":40,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L40-L66","documentation":"ValidateCodeException thrown when codeInSession.isExpire() is true for the SmsCode. SmsCode is created with a 60s lifetime. SECOND BUG: the removeAttribute call uses SESSION_KEY_IMAGE_CODE instead of SESSION_KEY_SMS_CODE + mobileInRequest, so even on success the wrong session key is cleared. As with error 67, the lookup itself is corrupted by the 'smsCode'-as-mobile bug, so this branch is rarely reached before 67 fires.","triggerScenarios":"More than 60s elapsed between GET /code/sms and /login/mobile (once the upstream mobile-key bug is fixed); stale SMS code submitted.","commonSituations":"60s SMS TTL too short; user waited for the text message and typed slowly; clock skew.","solutions":["Request a new SMS code via GET /code/sms?mobile=<num> and submit within 60s.","Increase the SmsCode lifetime in ValidateController.createSMSCode (currently new SmsCode(code, 60)).","Fix the wrong-key removal: sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest)."],"exampleFix":"// before\n// sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n// after\nsessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);","handlingStrategy":"retry","validationCode":"// Refresh SMS code if older than 50s (TTL 60s).\nlet smsSentAt = 0;\nif (Date.now() - smsSentAt > 50_000) { await resendSms(); smsSentAt = Date.now(); }","typeGuard":null,"tryCatchPattern":"try { await smsLogin(); }\ncatch (e) { if (/已过期/.test(e.message)) { await resendSms(); } else handleError(e); }","preventionTips":["Fix the wrong-key removal bug (use SESSION_KEY_SMS_CODE + mobile, not SESSION_KEY_IMAGE_CODE).","Show a countdown based on the 60s SMS TTL.","Raise the SmsCode lifetime if users need more time."],"tags":["sms","captcha","expiry","session","bug"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}