wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

ValidateCodeException thrown by ValidateCodeFilter.validateCode() when the submitted imageCode does not match the session code, compared case-insensitively (StringUtils.equalsIgnoreCase). All prior checks (present, exists, not expired) have passed, so this is purely a value mismatch - a genuine wrong answer.

Source

Thrown at 36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:58

        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

1. Tell the user to re-enter the code exactly as shown, ignoring case.
2. Refresh the captcha image and try again if unsure.
3. Trim the submitted value before comparing to avoid whitespace mismatches.
4. Use a less ambiguous captcha character set in generation.

Example fix

// before
if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
    throw new ValidateCodeException("验证码不正确！");
}

// after (trim + clearer message)
String clean = StringUtils.trim(codeInRequest);
if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), clean)) {
    throw new ValidateCodeException("验证码不正确,请刷新后重试！");
}

// normalize user input before submit
form.imageCode.value = form.imageCode.value.trim();
if (!form.imageCode.value) { showError('请输入图形验证码'); return; }

When it happens

Trigger: POST to login with a present, non-expired imageCode whose value differs from the one rendered in the captcha image.

Common situations: User misread the image (common with ambiguous chars like 0/O, 1/l/I); stale browser autocomplete filled an old code; the displayed image was refreshed but the user typed the previous code; case differences (handled, but whitespace is not trimmed).

Related errors

• 验证码不正确！
• 验证码不正确！
• 验证码不能为空！
• 验证码不存在！
• 验证码已过期！

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/51e06e7446677f03. Report an issue: GitHub.