wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

Thrown by SmsCodeFilter.validateCode when the session SmsCode exists but isExpire() returns true (default 60s from ValidateController.createSmsCode). BUG: the preceding removeAttribute call (line 57) removes SESSION_KEY_IMAGE_CODE instead of the SMS key, so it fails to clean up the actual SMS entry and silently removes an unrelated image-captcha entry.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:58

        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Submit the SMS code within the 60-second validity window.
  2. Re-request the code via GET /code/sms?mobile=<number> when it expires, and resubmit.
  3. Increase the SmsCode TTL in ValidateController.createSmsCode if needed.
  4. Fix line 57 removeAttribute to use SESSION_KEY_SMS_CODE + mobileInRequest so the correct expired entry is cleared.

Example fix

// before
int expireIn = 60; // SmsCode(code, 60)

// after
return new SmsCode(code, 180);
Defensive patterns

Strategy: validation

Validate before calling

// client-side countdown for the 60s SMS TTL
let ttl = 60;
if (--ttl <= 0) { await requestSms(mobile); ttl = 60; }

Try / catch

// AuthenticationFailureHandler: on '已过期', re-request SMS and prompt retry.

Prevention

When it happens

Trigger: More than 60 seconds elapsed between GET /code/sms and POST /login/mobile; the user took too long to enter the code.

Common situations: Long think-time; short 60s SMS TTL; user re-requested code but stale entry lingered due to the wrong removeAttribute key.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/6f5230adaf9653da. Report an issue: GitHub.