paascloud/paascloud-master · error · ValidateCodeException

验证码不匹配

Error message

验证码不匹配

What it means

Fires in AbstractValidateCodeProcessor.check when the code submitted in the request is non-blank but does not string-equal the code stored in the session repository. The stored code exists and is unexpired (those cases raise earlier errors), but the user entered the wrong value, so validation fails and the login/form flow is rejected.

Solutions

1. Have the user re-enter or re-request the code
2. Verify the deviceId header is identical on generate and validate requests
3. Re-request the code if a newer one may have been generated
4. Catch ValidateCodeException and return a clear 'incorrect code' message with limited retries

Example fix

// before
curl -H "deviceId:" -d smsCode=111 /code/validate
curl -d smsCode=222 /auth/login
// after
// same deviceId on both calls, and use the latest code
curl -H "deviceId:dev-1" -d smsCode=123456 /code/check
curl -H "deviceId:dev-1" -d smsCode=123456 /auth/login

try { processor.validate(request); } catch (ValidateCodeException e) { if (e.getMessage().contains("不匹配")) { retryCount++; if (retryCount >= 5) lockAccount(); } }

When it happens

Trigger: Typing the code wrong; submitting a code generated for a different deviceId; reusing a stale code after a new one was generated (repository holds only the latest).

Common situations: User transposes digits from an SMS; frontend cached an old code; two browser tabs each generated codes and the second overwrote the first; deviceId header differs between generate and validate requests.

Related errors

• 验证码的值不能为空
• 验证码处理器不存在
• 验证码生成器不存在
• 获取验证码的值失败
• 验证码已过期

AI-assisted analysis of paascloud/paascloud-master@781281a950 (2026-09-10). Data as JSON: /api/errors/9d01d56d6d230571. Report an issue: GitHub.

Appendix: source

Thrown at paascloud-common/paascloud-security-core/src/main/java/com/paascloud/security/core/validate/code/impl/AbstractValidateCodeProcessor.java:150

		String codeInRequest;
		try {
			codeInRequest = ServletRequestUtils.getStringParameter(request.getRequest(), codeType.getParamNameOnValidate());
		} catch (ServletRequestBindingException e) {
			throw new ValidateCodeException("获取验证码的值失败");
		}

		if (StringUtils.isBlank(codeInRequest)) {
			throw new ValidateCodeException(codeType + "验证码的值不能为空");
		}

		if (codeInSession == null || codeInSession.isExpired()) {
			validateCodeRepository.remove(request, codeType);
			throw new ValidateCodeException(codeType + "验证码已过期");
		}

		if (!StringUtils.equals(codeInSession.getCode(), codeInRequest)) {
			throw new ValidateCodeException(codeType + "验证码不匹配");
		}
	}
}

View on GitHub (pinned to 781281a950)