wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不能为空！

Error message

验证码不能为空！

What it means

Thrown by SmsCodeFilter.validateCode when the POST /login/mobile request omits a blank/absent 'smsCode' parameter. First validation gate of the SMS-captcha filter. Raised as ValidateCodeException and routed to AuthenticationFailureHandler. NOTE: line 46 has a copy-paste bug — mobileInRequest also reads the 'smsCode' param instead of 'mobile', but that does not affect this particular blank-check.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:51

                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Include a parameter literally named 'smsCode' in the POST /login/mobile body.
  2. Verify the front-end <input name="smsCode"> matches the backend parameter.
  3. Ensure the SMS-login flow collects the code from the user and appends it.
  4. Confirm the filter only intercepts /login/mobile POST.

Example fix

// before
fetch('/login/mobile', { method:'POST', body:new URLSearchParams({mobile:'13800000000'}) });

// after
fetch('/login/mobile', { method:'POST', body:new URLSearchParams({mobile:'13800000000', smsCode:'123456'}) });
Defensive patterns

Strategy: validation

Validate before calling

// client-side: ensure smsCode present before submit
const code = form.get('smsCode');
if (!code || !code.trim()) { showError('请输入短信验证码'); return; }

Try / catch

// SmsCodeFilter routes to AuthenticationFailureHandler; surface the message.

Prevention

When it happens

Trigger: A POST /login/mobile submission that omits the smsCode field, sends it empty, or names it differently. The filter runs only for requestURI '/login/mobile' and method POST.

Common situations: Front-end field named 'smsCode' missing from the payload; AJAX call forgets to include the typed code; field disabled.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/0b32f6ef3c0c1834. Report an issue: GitHub.