{"record":{"id":"e6320c6ebd58de7d","repo":"wuyouzhuguli/SpringAll","slug":"error-e6320c","errorCode":null,"errorMessage":"验证码不能为空！","messagePattern":"验证码不能为空！","errorType":"validation","errorClass":"ValidateCodeException","httpStatus":null,"severity":"error","filePath":"61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java","lineNumber":51,"sourceCode":"                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), \"post\")) {\n            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"smsCode\");\n\n        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);\n\n        if (StringUtils.isBlank(smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n}","sourceCodeStart":33,"sourceCodeEnd":66,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java#L33-L66","documentation":"ValidateCodeException thrown by SmsCodeFilter.validateCode (project 61) when the 'smsCode' request parameter is blank. This filter guards /login/mobile before SmsAuthenticationFilter runs. BUG NOTE: the next line reads the 'mobile' param as ServletRequestUtils.getStringParameter(..., \"smsCode\") again, so mobileInRequest is wrong downstream.","triggerScenarios":"POST to /login/mobile where the 'smsCode' form/query parameter is missing or empty. The blank check runs before the Redis/session lookup.","commonSituations":"Frontend omitted the smsCode field; field named 'code' instead of 'smsCode'; SMS code never arrived so the field was left empty.","solutions":["Include a non-empty 'smsCode' parameter in the /login/mobile POST body.","Confirm the frontend input is bound to the key 'smsCode' (not 'code' or 'verifyCode').","Also fix the companion bug: change the second getStringParameter to read 'mobile' so downstream session-key lookup is correct (see error 67)."],"exampleFix":"// before\n// String mobileInRequest = ServletRequestUtils.getStringParameter(req, \"smsCode\"); // wrong key\n\n// after\nString mobileInRequest = ServletRequestUtils.getStringParameter(req, \"mobile\");","handlingStrategy":"validation","validationCode":"// Validate the SMS code field before submit.\nconst code = form.get('smsCode');\nif (!code || !code.trim()) { showFieldError('smsCode','请输入短信验证码'); return; }","typeGuard":null,"tryCatchPattern":"try { await smsLogin(); }\ncatch (e) {\n  if (/不能为空/.test(e.message)) showFieldError('smsCode','请输入短信验证码');\n  else handleError(e);\n}","preventionTips":["Bind the SMS input to name 'smsCode'.","Disable submit until the code field is filled.","Fix the companion 'mobile' vs 'smsCode' read bug in the filter (errors 67-69)."],"tags":["spring-security","sms","captcha","validation","bug"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}