{"record":{"id":"cd8b8fb14718c821","repo":"wuyouzhuguli/SpringAll","slug":"error-cd8b8f","errorCode":null,"errorMessage":"验证码不能为空！","messagePattern":"验证码不能为空！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":48,"sourceCode":"    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {\n        if (StringUtils.equalsIgnoreCase(\"/login\", httpServletRequest.getRequestURI())\n                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), \"post\")) {\n            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":30,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L30-L65","documentation":"Thrown by ValidateCodeFilter.validateCode when the login POST to /login does not include an 'imageCode' request parameter (blank or absent). It is a ValidateCodeException raised inside the captcha-validation filter that runs before Spring Security authentication; the filter catches it and delegates to AuthenticationFailureHandler. The check is the first of four validation gates (empty -> not-in-session -> expired -> mismatch).","triggerScenarios":"A POST /login form submission that omits the imageCode field, sends it empty, or names the field something other than 'imageCode'. The filter only runs when requestURI equals '/login' and method is POST.","commonSituations":"Front-end input named 'captcha' or 'code' instead of 'imageCode'; an AJAX login that forgets to append the captcha value; a form where the captcha field is disabled or hidden; copying a tutorial form whose field name was changed.","solutions":["Ensure the login request body/form includes a parameter literally named 'imageCode' with the user-typed captcha text.","Verify the front-end <input name=\"imageCode\"> matches the backend ServletRequestUtils.getStringParameter(..., \"imageCode\").","Confirm the filter only intercepts /login POST so it does not fire on other endpoints that legitimately lack a captcha.","If captcha is optional on some flows, gate validateCode() on the presence of the imageCode param instead of throwing."],"exampleFix":"// before\nformData.append(\"captcha\", userTypedCode);\n\n// after\nformData.append(\"imageCode\", userTypedCode);","handlingStrategy":"validation","validationCode":"// client-side: ensure imageCode present before submit\nconst code = form.get('imageCode');\nif (!code || !code.trim()) { showError('请输入验证码'); return; }","typeGuard":null,"tryCatchPattern":"// ValidateCodeFilter already wraps validateCode() in try/catch and routes to\n// authenticationFailureHandler; surface the message to the user there.\n@Override\npublic void onAuthenticationFailure(req, res, e) {\n    res.getWriter().write(e.getMessage());\n}","preventionTips":["Standardize the imageCode field name across front-end and back-end.","Disable submit until the captcha field is non-empty.","Confirm the filter only intercepts the login URL."],"tags":["spring-security","captcha","validation","filter","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}