wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

Thrown when StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest) is false: the submitted captcha text does not match the value stored in session. Comparison is case-insensitive, so only the actual digits/letters matter. The session attribute is removed after this check.

Source

Thrown at 61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:58

        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Re-enter the captcha exactly as shown in the current image (case does not matter).
  2. Refresh GET /code/image to get a new, clearer code and resubmit within the 60s window.
  3. If the image is consistently unreadable, tweak createImageCode (font size, fewer干扰线, larger canvas) for legibility.
Defensive patterns

Strategy: validation

Validate before calling

// Basic sanity check before submit (length matches generated 4-digit code).
const code = form.get('imageCode');
if (!/^\d{4}$/.test(code || '')) { showFieldError('imageCode','请输入4位验证码'); return; }

Try / catch

try { await login(); }
catch (e) {
  if (/不正确/.test(e.message)) { await refreshCaptcha(); }
  else handleError(e);
}

Prevention

When it happens

Trigger: User typed the wrong characters; the captcha image was misread (ambiguous 0/O, 1/I/l); the submitted value belongs to a different/older captcha image than the one in session.

Common situations: Hard-to-read generated image; user copy-pasted stale captcha; frontend displayed a cached image while the session held a newer code.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/89e67524a1a4a9b1. Report an issue: GitHub.