wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

Thrown by ValidateCodeFilter.validateCode (Logout project) when the session ImageCode is expired (isExpire() true, default 60s). The expired code is removed before throwing.

Source

Thrown at 60.Spring-Security-Logout/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:55

                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Submit within the 60-second window.
  2. Auto-refresh the captcha image before it expires.
  3. Raise expireIn in createImageCode.
  4. Show a client countdown and re-fetch the image at zero.

Example fix

// before
int expireIn = 60;

// after
int expireIn = 180;
Defensive patterns

Strategy: validation

Validate before calling

// client-side countdown for the 60s TTL
let ttl = 60;
if (--ttl <= 0) { refreshCaptcha(); ttl = 60; }

Try / catch

// AuthenticationFailureHandler: on expiry, refresh image and ask to retry.

Prevention

When it happens

Trigger: More than 60s elapsed between GET /code/image and POST /login; stale captcha submitted.

Common situations: Long idle on the login form; short TTL; slow entry.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/5ac7b0141826b8f6. Report an issue: GitHub.