wuyouzhuguli/SpringAll · warning · Exception
验证码不正确！
Error message
验证码不正确！
What it means
A plain java.lang.Exception '验证码不正确！' (verification code incorrect) is thrown by SmsCodeFilter.validateCode when the code stored in Redis does not equal the code submitted in the request (case-insensitive comparison via StringUtils.equalsIgnoreCase). It is the mismatch branch of the SMS-code validation gate, reached only after the empty-code and expired checks pass.
Source
Thrown at 65.Spring-Security-OAuth2-Config/src/main/java/cc/mrbird/security/validate/smscode/SmsCodeFilter.java:55
}
}
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
private void validateCode(ServletWebRequest servletWebRequest) throws Exception {
String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");
String codeInRedis = redisCodeService.get(servletWebRequest, mobileInRequest);
if (StringUtils.isBlank(smsCodeInRequest)) {
throw new Exception("验证码不能为空！");
}
if (codeInRedis == null) {
throw new Exception("验证码已过期！");
}
if (!StringUtils.equalsIgnoreCase(codeInRedis, smsCodeInRequest)) {
throw new Exception("验证码不正确！");
}
redisCodeService.remove(servletWebRequest, mobileInRequest);
}
}View on GitHub (pinned to 614d2578d9)
Solutions
- Have the user re-enter the most recent code received, ensuring no leading/trailing whitespace or newline is included.
- Confirm the code submitted corresponds to the same mobile used as the Redis key (mismatched mobile vs code is a common cause).
- If resends overwrite the same key, document that only the last-sent code is valid; consider rate-limiting resends to avoid user confusion.
- Trim the request parameter before comparison to absorb whitespace from copy-paste, and keep the comparison case-insensitive (already done).
- Replace the raw Exception with a ValidateCodeException so the failure is reported as a 4xx through the security failure handler.
Example fix
// before
if (!StringUtils.equalsIgnoreCase(codeInRedis, smsCodeInRequest)) {
throw new Exception("验证码不正确！");
}
// after — trim input + typed exception
String submitted = StringUtils.trim(smsCodeInRequest);
if (!StringUtils.equalsIgnoreCase(codeInRedis, submitted)) {
throw new ValidateCodeException("验证码不正确！");
} Defensive patterns
Strategy: validation
Validate before calling
// Compare before invoking the throwing filter chain
String stored = redisCodeService.get(new ServletWebRequest(request), mobile);
String submitted = request.getParameter("smsCode");
if (stored == null || !stored.equalsIgnoreCase(submitted == null ? "" : submitted.trim())) {
return "验证码不正确，请重新输入";
} Type guard
private boolean codeMatches(ServletWebRequest req, String mobile) {
String stored = redisCodeService.get(req, mobile);
String submitted = ServletRequestUtils.getStringParameter(req.getRequest(), "smsCode");
return stored != null && submitted != null
&& stored.equalsIgnoreCase(submitted.trim());
} Try / catch
try {
filterChain.doFilter(request, response);
} catch (Exception e) {
if ("验证码不正确！".equals(e.getMessage())) {
response.setStatus(400);
response.getWriter().write("验证码不正确");
} else {
throw e;
}
} Prevention
- Have the user enter only the most recent code received, since resends overwrite the same Redis key.
- Trim whitespace/newlines from the submitted code before comparison to absorb copy-paste artifacts.
- Ensure the mobile used as the Redis key is the same one the code was issued for.
- Throw a typed ValidateCodeException instead of raw Exception so the failure routes through Spring Security's failure handler.
When it happens
Trigger: The request's 'smsCode' parameter differs from the value stored under the mobile's Redis key: user mistyped the code, the code was generated for a different mobile, or the stored value was overwritten by a newer send (the key now holds a code the user did not request). Transient whitespace or a trailing newline from copy-paste can also cause a mismatch despite a case-insensitive compare.
Common situations: Typo on the numeric keypad; stale code displayed because the user requested a resend and entered the first (now-overwritten) code; frontend cached an old code; or the SMS gateway delivered codes out of order so the user typed an earlier one.
Related errors
AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14).
Data as JSON: /api/errors/5d6d356b088e71d3.
Report an issue: GitHub.