wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

Thrown by SmsCodeFilter.validateCode when the submitted smsCode does not case-insensitively equal the stored session code. Even when reached, the surrounding code is unreliable due to two source bugs: mobileInRequest is read from the wrong param (line 46) and the final removeAttribute (line 63) clears SESSION_KEY_IMAGE_CODE instead of the SMS key, so the consumed SMS code is never invalidated.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:61

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Fix line 46 so the lookup uses the correct mobile parameter, restoring accurate session-key matching.
  2. Have the user re-enter the exact 6-digit code from the latest SMS.
  3. Re-request the SMS code and resubmit promptly.
  4. Fix line 63 removeAttribute to clear SESSION_KEY_SMS_CODE + mobile after success.

Example fix

// before
// mismatch due to wrong session key from line-46 bug

// after
String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);
Defensive patterns

Strategy: validation

Validate before calling

// client-side: require exact 6-digit smsCode before submit
const code = (form.get('smsCode') || '').trim();
if (!/^\d{6}$/.test(code)) { showError('请输入6位短信验证码'); return; }

Try / catch

// AuthenticationFailureHandler: on mismatch, re-request SMS and retry.

Prevention

When it happens

Trigger: User mistyped the SMS code; stale code submitted; or — due to the line 46 bug — the wrong session entry is read, producing a mismatch.

Common situations: Misread code; previously-requested code still entered after refresh; cross-contamination from the wrong session key caused by the mobile-param bug.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/705550e0505a5c13. Report an issue: GitHub.