wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不存在！

Error message

验证码不存在！

What it means

Thrown by ValidateCodeFilter.validateCode (Logout project) when the session has no ImageCode under SESSION_KEY_IMAGE_CODE. No captcha was generated/stored for the session, or the session was lost. Routed to AuthenticationFailureHandler.

Source

Thrown at 60.Spring-Security-Logout/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:51

            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Load GET /code/image (stores ImageCode in session) before submitting /login.
  2. Preserve JSESSIONID across both requests.
  3. Verify createCode stores under SESSION_KEY_IMAGE_CODE.
  4. Use sticky sessions or a shared session store behind a load balancer.

Example fix

// before
// submit /login without loading captcha

// after
fetch('/code/image').then(() => enableSubmit());
Defensive patterns

Strategy: validation

Validate before calling

// client-side: load captcha image first
fetch('/code/image').then(() => enableSubmit());

Try / catch

// AuthenticationFailureHandler: treat missing session as '请先获取验证码'.

Prevention

When it happens

Trigger: POST /login without a prior GET /code/image in the same JSESSIONID; session expired or not shared between the image fetch and the submit.

Common situations: Cookies blocked; load balancer without sticky sessions; image endpoint failed; redeploy cleared sessions.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/4238677509c1fb13. Report an issue: GitHub.