{"record":{"id":"dff958e223f04564","repo":"wuyouzhuguli/SpringAll","slug":"error-dff958","errorCode":null,"errorMessage":"验证码不正确！","messagePattern":"验证码不正确！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":58,"sourceCode":"        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":40,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L40-L65","documentation":"Thrown by ValidateCodeFilter.validateCode when the submitted imageCode request parameter does not case-insensitively equal the code stored in session (StringUtils.equalsIgnoreCase fails). This is the mismatch gate after the empty/null/expired checks pass. Raised as ValidateCodeException and routed to AuthenticationFailureHandler, and the consumed code is then removed from session.","triggerScenarios":"The user mistyped the captcha; the image was ambiguous; OCR misread; or the submitted code belongs to a previously-refreshed captcha whose session entry was already replaced.","commonSituations":"Hard-to-read generated digits; stale captcha image still shown after a refresh; case/whitespace handling differences (note the comparison is trimmed only by the form, not here).","solutions":["Tell the user to re-type the code exactly as shown and reload a fresh image.","Ensure the front-end submits the raw code with no extra whitespace/trimming that diverges from the stored value.","Refresh the captcha image before resubmitting so the session code and displayed code match.","If the image is frequently misread, tune the generateCode (more length/clearer font) in ValidateController."],"exampleFix":"// before\nformData.append(\"imageCode\", userGuess);\n\n// after\n// re-fetch a fresh image first, then submit the exact displayed code\nrefreshCaptcha().then(() => formData.append(\"imageCode\", exactDisplayedCode));","handlingStrategy":"validation","validationCode":"// client-side: trim and require exact 4-digit code before submit\nconst code = (form.get('imageCode') || '').trim();\nif (!/^\\d{4}$/.test(code)) { showError('验证码格式不正确'); return; }","typeGuard":null,"tryCatchPattern":"// AuthenticationFailureHandler: on mismatch, refresh image and ask to retry.","preventionTips":["Refresh the image before retrying.","Submit the exact displayed code without extra whitespace.","Improve captcha legibility if mismatches are frequent."],"tags":["spring-security","captcha","validation","java"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}