wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

ValidateCodeException thrown when codeInSession.isExpire() is true for the SmsCode. SmsCode is created with a 60s lifetime. SECOND BUG: the removeAttribute call uses SESSION_KEY_IMAGE_CODE instead of SESSION_KEY_SMS_CODE + mobileInRequest, so even on success the wrong session key is cleared. As with error 67, the lookup itself is corrupted by the 'smsCode'-as-mobile bug, so this branch is rarely reached before 67 fires.

Source

Thrown at 61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:58

        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Request a new SMS code via GET /code/sms?mobile=<num> and submit within 60s.
  2. Increase the SmsCode lifetime in ValidateController.createSMSCode (currently new SmsCode(code, 60)).
  3. Fix the wrong-key removal: sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest).

Example fix

// before
// sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

// after
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);
Defensive patterns

Strategy: retry

Validate before calling

// Refresh SMS code if older than 50s (TTL 60s).
let smsSentAt = 0;
if (Date.now() - smsSentAt > 50_000) { await resendSms(); smsSentAt = Date.now(); }

Try / catch

try { await smsLogin(); }
catch (e) { if (/已过期/.test(e.message)) { await resendSms(); } else handleError(e); }

Prevention

When it happens

Trigger: More than 60s elapsed between GET /code/sms and /login/mobile (once the upstream mobile-key bug is fixed); stale SMS code submitted.

Common situations: 60s SMS TTL too short; user waited for the text message and typed slowly; clock skew.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/a4be01ba888ac78c. Report an issue: GitHub.