wuyouzhuguli/SpringAll · error · ValidateCodeException

验证码不存在！

Error message

验证码不存在！

What it means

Thrown by SmsCodeFilter.validateCode when no SmsCode is found in session under key (SESSION_KEY_SMS_CODE + mobileInRequest). CRITICAL BUG in source: line 46 reads mobileInRequest from the 'smsCode' parameter, not 'mobile', so the session key is built from the SMS code value rather than the mobile number — which will almost never equal the key stored under SESSION_KEY_SMS_CODE+mobile. This error therefore fires on nearly every valid SMS login even when the code is correct.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:54

            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Fix line 46: read mobileInRequest from the 'mobile' parameter, not 'smsCode': ServletRequestUtils.getStringParameter(req, "mobile").
  2. Ensure the client calls GET /code/sms?mobile=<number> before POST /login/mobile to store the code under SESSION_KEY_SMS_CODE+mobile.
  3. Confirm the submitted 'mobile' value exactly matches the one used when requesting the SMS code.
  4. Preserve JSESSIONID across /code/sms and /login/mobile.

Example fix

// before
String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

// after
String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");
Defensive patterns

Strategy: validation

Validate before calling

// client-side: request SMS code with mobile, then submit same mobile + smsCode
await fetch(`/code/sms?mobile=${encodeURIComponent(mobile)}`);
// then POST with both mobile and smsCode

Try / catch

// after fixing line 46, treat '不存在' as '请先获取验证码' in AuthenticationFailureHandler

Prevention

When it happens

Trigger: Any SMS login because the session key lookup uses the wrong parameter; or legitimately when /code/sms was never called for that mobile in the same session, or the session expired.

Common situations: The copy-paste bug on line 46 dominates; additionally, mobile param name mismatch, missing GET /code/sms?mobile=..., or session loss.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/8fd7b3b11f6d7d33. Report an issue: GitHub.