{"record":{"id":"d86878017af706b5","repo":"wuyouzhuguli/SpringAll","slug":"error-d86878","errorCode":null,"errorMessage":"验证码不存在！","messagePattern":"验证码不存在！","errorType":"exception","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":51,"sourceCode":"            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":33,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L33-L65","documentation":"Same ValidateCodeException thrown by ValidateCodeFilter.validateCode(). This branch fires when the captcha stored in the HTTP session (ImageCode under ValidateController.SESSION_KEY_IMAGE_CODE) is null, i.e., no captcha was ever generated for this session or it was already removed/expired. It indicates a session-state problem, not a user typo.","triggerScenarios":"POST to login with a non-empty imageCode but no matching ImageCode object in the session - the user never requested GET /code/image, or the session that generated the captcha differs from the session submitting the form.","commonSituations":"Browser blocked the JSESSIONID cookie so each request is a new session; captcha image endpoint /code/image was never hit; session timed out between rendering the form and submitting; load balancer without sticky sessions routes generation and login to different nodes; the captcha was already consumed/removed by a previous submit.","solutions":["Ensure the browser requests the captcha image (GET /code/image) before submitting login, in the same session.","Verify cookies (JSESSIONID) are accepted and sent on both requests; check SameSite/secure flags.","For clustered deployments, use a shared session store (Redis) or sticky sessions so generation and login share state.","Check session timeout (server.servlet.session.timeout) is long enough for user input."],"exampleFix":"// before: client requests only the login POST\nPOST /authentication/form  imageCode=ABCD   // session has no ImageCode -> 不存在\n\n// after: client fetches the captcha image first, same JSESSIONID\nGET  /code/image           // sets session ImageCode\nPOST /authentication/form  imageCode=ABCD   // Cookie: JSESSIONID=...","handlingStrategy":"retry","validationCode":"// ensure a captcha exists in this session before allowing submit\nfetch('/code/image', { credentials: 'same-origin' })\n  .then(() => enableLoginForm());","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always fetch GET /code/image in the same session before submitting login.","Ensure the JSESSIONID cookie is sent (same-origin / credentials) on both requests.","Use sticky sessions or a shared session store in clustered deployments."],"tags":["spring-security","captcha","session","validation"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}