{"record":{"id":"ab5c0ed12613efae","repo":"wuyouzhuguli/SpringAll","slug":"error-ab5c0e","errorCode":null,"errorMessage":"验证码不能为空！","messagePattern":"验证码不能为空！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":48,"sourceCode":"    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {\n        if (StringUtils.equalsIgnoreCase(\"/login\", httpServletRequest.getRequestURI())\n                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), \"post\")) {\n            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":30,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L30-L65","documentation":"Custom ValidateCodeException thrown inside ValidateCodeFilter.validateCode when the submitted 'imageCode' request parameter is blank. This filter runs before username/password authentication and rejects the request early if the captcha value is missing. It is part of the mrbird Spring Security image-captcha flow (session key SESSION_KEY_IMAGE_CODE).","triggerScenarios":"A POST to the login URL that the filter intercepts where the form body / query string / JSON omits the 'imageCode' parameter, or sends it as empty/whitespace. ServletRequestUtils.getStringParameter(..., \"imageCode\") returns null/empty and StringUtils.isBlank is true before the session code is even consulted.","commonSituations":"Frontend form field named differently (verifyCode, captcha, code) instead of 'imageCode'; AJAX/fetch login payload that forgot to append the captcha; Postman/curl testing without the param; the captcha <img> was displayed but its input never bound to the request.","solutions":["Ensure the login request includes a non-empty 'imageCode' parameter whose name exactly matches what ValidateCodeFilter reads.","Check the frontend field name binding: the captcha input must be submitted under the key 'imageCode'.","If you intentionally want a route to bypass captcha, configure the filter's URL set (the urls check above the validateCode call) so it does not run for that path.","For API testing with Postman/curl, add -F imageCode=<value> (or the matching param) plus a valid JSESSIONID cookie from /code/image."],"exampleFix":"// before (curl missing captcha)\n// curl -b cookies.txt -X POST http://host/login -d 'username=admin&password=123456'\n\n// after\n// curl -b cookies.txt -X POST http://host/login -d 'username=admin&password=123456&imageCode=1234'","handlingStrategy":"validation","validationCode":"// Before submitting login, ensure the captcha field is present and non-empty.\nconst imageCode = form.get('imageCode');\nif (!imageCode || !imageCode.trim()) {\n  showError('请输入图片验证码');\n  return;\n}\nawait fetch('/login', { method:'POST', body: form, credentials:'same-origin' });","typeGuard":null,"tryCatchPattern":"// ValidateCodeException is routed to authenticationFailureHandler; map it to a user-facing message.\ntry { await login(); }\ncatch (e) {\n  if (/验证码不能为空/.test(e.message)) showFieldError('imageCode', '验证码不能为空');\n  else handleError(e);\n}","preventionTips":["Bind the captcha <input name=\"imageCode\"> to the same key the filter reads.","Disable the submit button until imageCode is non-empty.","Fetch /code/image with credentials:'same-origin' so the session is shared."],"tags":["spring-security","captcha","validation","authentication","request-binding"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}