wuyouzhuguli/SpringAll · warning · Exception

验证码不正确！

Error message

验证码不正确！

What it means

Generic Exception thrown when equalsIgnoreCase(codeInRedis, smsCodeInRequest) is false: the submitted SMS code does not match the value stored in Redis for 'SMS_CODE:deviceId:mobile'. Comparison is case-insensitive. The code is removed from Redis only on success, so a wrong attempt does not consume it.

Source

Thrown at 64.Spring-Security-OAuth2-Customize/src/main/java/cc/mrbird/security/validate/smscode/SmsCodeFilter.java:55

            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws Exception {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");

        String codeInRedis = redisCodeService.get(servletWebRequest, mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new Exception("验证码不能为空！");
        }
        if (codeInRedis == null) {
            throw new Exception("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInRedis, smsCodeInRequest)) {
            throw new Exception("验证码不正确！");
        }
        redisCodeService.remove(servletWebRequest, mobileInRequest);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Re-enter the exact code from the latest SMS for the same mobile and deviceId.
  2. Ensure deviceId is identical between /code/sms and /login/mobile so the same Redis key is read.
  3. Avoid multiple resends before submitting; use only the most recent code.
Defensive patterns

Strategy: validation

Validate before calling

// Sanity-check the 6-digit code and key consistency before submit.
const code = form.get('smsCode');
if (!/^\d{6}$/.test(code || '')) { showFieldError('smsCode','请输入6位短信验证码'); return; }
// also ensure deviceId + mobile match what was used at /code/sms

Try / catch

try { await smsLogin(); }
catch (e) {
  if (/不正确/.test(e.message)) { await resendSms(); /* enter the latest code */ }
  else handleError(e);
}

Prevention

When it happens

Trigger: User entered the wrong 6-digit code; the code in Redis belongs to a different mobile/deviceId key; the code was retried with a stale value after a resend.

Common situations: Typo in the 6-digit code; resend overwrote the key and the user entered the older code; deviceId differed so a different key's code was compared.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/2adff4b219d6421e. Report an issue: GitHub.