wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

Thrown by ValidateCodeFilter.validateCode when the session ImageCode exists but its isExpire() returns true. The captcha (default 60s, ValidateController.createImageCode) outlived its validity window. Before throwing, the filter removes the expired code from session so it cannot be reused.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:55

                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Submit the form within the 60-second validity window configured in createImageCode.
  2. Auto-refresh the captcha image (re-call GET /code/image) when it is about to expire.
  3. Increase the expireIn value in ValidateController.createImageCode if users legitimately need more time.
  4. On the client, show a countdown and force a re-fetch of the image when it hits zero.

Example fix

// before
int expireIn = 60; // 验证码有效时间 60s

// after
int expireIn = 180; // allow more time
Defensive patterns

Strategy: validation

Validate before calling

// client-side countdown matching the 60s TTL
let ttl = 60;
const t = setInterval(() => { if (--ttl <= 0) { refreshCaptcha(); ttl = 60; } }, 1000);

Try / catch

// AuthenticationFailureHandler shows '验证码已过期，请刷新'; prompt re-fetch.

Prevention

When it happens

Trigger: More than the configured expireIn (60s) elapsed between GET /code/image and the POST /login; the user left the page idle then submitted the stale captcha.

Common situations: Long user think-time on the login form; short captcha TTL; clock/session delays; slow typing that exceeds 60 seconds.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/41b3877c68b0eee0. Report an issue: GitHub.