{"record":{"id":"b957538723d83c56","repo":"wuyouzhuguli/SpringAll","slug":"error-b95753","errorCode":null,"errorMessage":"验证码不存在！","messagePattern":"验证码不存在！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":51,"sourceCode":"            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":33,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L33-L65","documentation":"Thrown when sessionStrategy.getAttribute returns null for SESSION_KEY_IMAGE_CODE, meaning no ImageCode was ever stored in the HTTP session for this client. The captcha must first be generated via GET /code/image (ValidateController.createCode) which writes the code into the same session, then submitted on login.","triggerScenarios":"Login POST is sent without first GETting /code/image in the same session; the JSESSIONID cookie differs between the /code/image request and the login request; the session expired on the server; a previous successful/failed login already consumed the code (note: successful login path removes it only on match, but session invalidation on login can also drop it).","commonSituations":"Browser blocked third-party/SameSite cookies so a fresh session was created for the login call; load-balanced cluster without session affinity (sticky session) or without Spring Session shared store; incognito/new tab where the captcha image was fetched in another session; server restart with in-memory sessions.","solutions":["Always load GET /code/image in the same browser session immediately before submitting login, and reuse the same JSESSIONID cookie.","Verify the JSESSIONID cookie is present and identical on both the /code/image and the login requests (check DevTools Network).","In a clustered deployment, enable Spring Session + Redis (or sticky sessions) so the captcha is visible to every node.","Raise server session timeout if users sit on the login page a long time before the captcha is fetched."],"exampleFix":null,"handlingStrategy":"validation","validationCode":"// Ensure a captcha was generated in this session before allowing submit.\nconst hasImage = sessionStorage.getItem('captchaFetched');\nif (!hasImage) { await refreshCaptcha(); }\n// refreshCaptcha does: fetch('/code/image', { credentials:'same-origin' }) then sets the flag\nform.addEventListener('submit', ...)","typeGuard":null,"tryCatchPattern":"try { await login(); }\ncatch (e) {\n  if (/验证码不存在/.test(e.message)) { await refreshCaptcha(); retry(); }\n  else handleError(e);\n}","preventionTips":["Always GET /code/image before login in the same session (same JSESSIONID).","Send credentials:'same-origin' / include cookies on both requests.","In clusters, use Spring Session + Redis for shared session state.","Refresh the captcha whenever the session might have changed (tab refocus, long idle)."],"tags":["spring-security","session","captcha","http-session","clustering"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}