wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

ValidateCodeException thrown by ValidateCodeFilter.validateCode() when the session ImageCode reports it has expired (codeInSession.isExpire()). The filter removes the stale session attribute before throwing, so the user must obtain a fresh captcha. Expire is computed from the code's creation time vs. a configured TTL.

Source

Thrown at 36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:55

                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

1. Refresh the captcha image and resubmit promptly.
2. Increase the captcha expireIn (seconds) in the code-generation configuration.
3. Regenerate the image automatically on focus/submit when it is stale.
4. Show a countdown to the user so they know the code's lifetime.

Example fix

// before
// validateConfig with short TTL
imageCode.setExpireTime(LocalDateTime.now().plusSeconds(30));

// after
imageCode.setExpireTime(LocalDateTime.now().plusSeconds(180));

// client-side: refresh the captcha and track its lifetime
function refreshCaptcha() {
    document.getElementById('captchaImg').src = '/code/image?t=' + Date.now();
    captchaGeneratedAt = Date.now();
}
// if older than the configured TTL, refresh before submit
if (Date.now() - captchaGeneratedAt > TTL_MS) refreshCaptcha();

When it happens

Trigger: POST to login with a non-empty, present imageCode whose age exceeds the configured expireIn (often 60 seconds in these demos).

Common situations: User left the login page open too long before submitting; expireIn is set very short; slow typing or a distraction; captcha generated, then a retry long after.

Related errors

• 验证码已过期！
• 验证码已过期！
• 验证码已过期！
• 验证码已过期！
• 验证码已过期！

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/960fdfa8711a5679. Report an issue: GitHub.