wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

ValidateCodeException thrown when equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest) is false: the submitted SMS code does not match the one in session. Same wrong-key removal bug as 68 applies after this throw. In this project the SMS code is printed to the server console (ValidateController: '您的登录验证码为...') instead of being texted.

Source

Thrown at 61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:61

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Copy the exact 6-digit code printed to the server console (or delivered by SMS) and resubmit.
  2. Ensure only one GET /code/sms per mobile is outstanding to avoid session-value overwrite confusion.
  3. After fixing the mobileInRequest bug (errors 67/68), confirm the comparison runs against the code stored for the correct mobile.
Defensive patterns

Strategy: validation

Validate before calling

// Sanity-check the 6-digit code before submit.
const code = form.get('smsCode');
if (!/^\d{6}$/.test(code || '')) { showFieldError('smsCode','请输入6位短信验证码'); return; }

Try / catch

try { await smsLogin(); }
catch (e) { if (/不正确/.test(e.message)) { await resendSms(); } else handleError(e); }

Prevention

When it happens

Trigger: User typed the wrong 6-digit code; the code in session belongs to a different mobile (compounded by the mobileInRequest bug); the code was read from the console but mistyped.

Common situations: Manual testing where the developer copies the console-printed code incorrectly; SMS delivery delay so the user resends and enters the older code; multiple /code/sms calls overwrote the session value.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/6f8c22339a00ea44. Report an issue: GitHub.