{"record":{"id":"f634f07de954b36e","repo":"wuyouzhuguli/SpringAll","slug":"error-f634f0","errorCode":null,"errorMessage":"验证码不能为空！","messagePattern":"验证码不能为空！","errorType":"exception","errorClass":"ValidateCodeException","httpStatus":null,"severity":"warning","filePath":"36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java","lineNumber":48,"sourceCode":"    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {\n        if (StringUtils.equalsIgnoreCase(\"/login\", httpServletRequest.getRequestURI())\n                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), \"post\")) {\n            try {\n                validateCode(new ServletWebRequest(httpServletRequest));\n            } catch (ValidateCodeException e) {\n                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);\n                return;\n            }\n        }\n        filterChain.doFilter(httpServletRequest, httpServletResponse);\n    }\n\n    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {\n        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), \"imageCode\");\n\n        if (StringUtils.isBlank(codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不能为空！\");\n        }\n        if (codeInSession == null) {\n            throw new ValidateCodeException(\"验证码不存在！\");\n        }\n        if (codeInSession.isExpire()) {\n            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n            throw new ValidateCodeException(\"验证码已过期！\");\n        }\n        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {\n            throw new ValidateCodeException(\"验证码不正确！\");\n        }\n        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);\n\n    }\n\n}\n","sourceCodeStart":30,"sourceCodeEnd":65,"githubUrl":"https://github.com/wuyouzhuguli/SpringAll/blob/614d2578d9495acf53cc02f2dee9c6131cc5e51a/36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java#L30-L65","documentation":"ValidateCodeException is a custom RuntimeException (cc.mrbird.validate.code.ValidateCodeException). ValidateCodeFilter.validateCode() runs before the login POST in the Spring Security filter chain; this branch fires when the submitted imageCode request parameter is null or blank (StringUtils.isBlank). The filter's doFilter catches it and routes it to authenticationFailureHandler, so authentication never proceeds.","triggerScenarios":"POST to the configured login URL with the imageCode form field missing, empty, or whitespace-only.","commonSituations":"The login form omits the imageCode input; the field's name attribute differs from 'imageCode'; an automated test/curl client does not send imageCode; a copy-pasted form dropped the captcha field.","solutions":["Add <input type=\"text\" name=\"imageCode\"> to the login form and submit a non-empty value.","Confirm the request parameter name matches the filter's getStringParameter(...,\"imageCode\").","Add client-side required-field validation to block empty submission before the request.","In integration tests, always include a non-empty imageCode parameter."],"exampleFix":"// before\n<form method=\"post\" action=\"/authentication/form\">\n  <input name=\"username\"/>\n  <input name=\"password\"/>\n  <!-- captcha field missing -->\n</form>\n\n// after\n<form method=\"post\" action=\"/authentication/form\">\n  <input name=\"username\"/>\n  <input name=\"password\"/>\n  <input type=\"text\" name=\"imageCode\" required/>\n</form>","handlingStrategy":"validation","validationCode":"// front-end guard before submitting the login form\nif (!form.imageCode || form.imageCode.trim() === '') {\n    showError('请输入图形验证码');\n    return;\n}\nform.submit();","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Mark the captcha input required and disable submit until it is filled.","Match the form field name attribute exactly to the parameter the filter reads ('imageCode').","Include a non-empty imageCode in every login integration test."],"tags":["spring-security","captcha","validation","form"],"backgroundTag":null,"analyzedSha":"614d2578d9495acf53cc02f2dee9c6131cc5e51a","analyzedAt":"2026-08-14T04:40:03.488Z","schemaVersion":2},"datasetVersion":"2026-08-14T05:17:29.042Z"}