wuyouzhuguli/SpringAll · error · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

ValidateCodeException thrown by SmsCodeFilter.validateCode() when the submitted smsCode does not equal the session code (case-insensitive). NOTE: the success-cleanup path on line 63 has the same copy-paste defect as the expiry path - it removes SESSION_KEY_IMAGE_CODE instead of SESSION_KEY_SMS_CODE + mobileInRequest, so a successful match corrupts the image-captcha session attribute and leaves the consumed SMS code in the session (replay risk). Reachable correctly only after the line-46 mobile bug is fixed.

Source

Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:61

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

1. Fix line 63 to remove ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest on success.
2. Also fix line 46 so mobileInRequest is read from the 'mobile' parameter.
3. Have the user re-enter the SMS code exactly, ignoring case.
4. Regenerate the SMS code if the user is unsure.

Example fix

// before (line 63)
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

// after
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

// normalize user input before submit
form.smsCode.value = form.smsCode.value.trim();
if (!form.smsCode.value) { showError('请输入短信验证码'); return; }

When it happens

Trigger: POST to /login/mobile with a present, non-expired smsCode whose value differs from the generated SMS code; or, after fixing line 46, any genuine mismatch.

Common situations: User mistyped the SMS code; code regenerated but old one typed; the success path clears the wrong attribute (line 63 bug) enabling SMS-code reuse; line-46 bug means the compared session code is for the wrong key.

Related errors

• 验证码不存在！
• 验证码已过期！
• 验证码不正确！
• 验证码不正确！
• 验证码不正确！

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/72795f35a843eb79. Report an issue: GitHub.