wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

Thrown by SmsCodeFilter.validateCode (Logout project) when the submitted smsCode does not case-insensitively match the session code. The surrounding code is unreliable due to two bugs: line 46 reads mobileInRequest from the wrong param, and line 63 removeAttribute clears SESSION_KEY_IMAGE_CODE instead of the SMS key, so the consumed SMS code is never invalidated.

Solutions

  1. Fix line 46 so the lookup uses the correct 'mobile' parameter.
  2. Have the user re-enter the exact 6-digit code from the latest SMS.
  3. Re-request the SMS code and resubmit promptly.
  4. Fix line 63 to clear SESSION_KEY_SMS_CODE + mobileInRequest on success.

Example fix

// before
// mismatch due to wrong session key from line-46 bug

// after
String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);
Defensive patterns

Strategy: validation

Validate before calling

// client-side: require exact 6-digit smsCode
const code = (form.get('smsCode') || '').trim();
if (!/^\d{6}$/.test(code)) { showError('请输入6位短信验证码'); return; }

Try / catch

// AuthenticationFailureHandler: on mismatch, re-request SMS and retry.

Prevention

When it happens

Trigger: User mistyped the code; stale code entered; or a mismatch produced by the wrong session key from the line-46 bug.

Common situations: Misread code; stale entry; cross-contamination from the wrong session key.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/898a4be6b72b2ae4. Report an issue: GitHub.

Appendix: source

Thrown at 60.Spring-Security-Logout/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:61

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)