wuyouzhuguli/SpringAll · error · Exception

验证码不能为空！

Error message

验证码不能为空！

What it means

Generic java.lang.Exception thrown by SmsCodeFilter.validateCode (project 64) when the 'smsCode' request parameter is blank, before the Redis lookup. Note this project throws plain Exception (caught by doFilterInternal and wrapped in AuthenticationServiceException), unlike project 61's ValidateCodeException.

Source

Thrown at 64.Spring-Security-OAuth2-Customize/src/main/java/cc/mrbird/security/validate/smscode/SmsCodeFilter.java:49

                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (Exception e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, new AuthenticationServiceException(e.getMessage()));
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws Exception {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "mobile");

        String codeInRedis = redisCodeService.get(servletWebRequest, mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new Exception("验证码不能为空！");
        }
        if (codeInRedis == null) {
            throw new Exception("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInRedis, smsCodeInRequest)) {
            throw new Exception("验证码不正确！");
        }
        redisCodeService.remove(servletWebRequest, mobileInRequest);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Include a non-empty 'smsCode' parameter in the /login/mobile POST body.
  2. Verify the frontend binds the SMS input to the key 'smsCode'.
  3. Frontend should disable submit until the code field is filled.

Example fix

// before
// fetch('/login/mobile', { method:'POST', body:'mobile=13800000000' })

// after
fetch('/login/mobile', {
  method:'POST',
  headers:{ 'deviceId':id },
  body:'mobile=13800000000&smsCode=123456'
});
Defensive patterns

Strategy: validation

Validate before calling

// Validate the SMS code field before submit.
const code = form.get('smsCode');
if (!code || !code.trim()) { showFieldError('smsCode','请输入短信验证码'); return; }

Try / catch

try { await smsLogin(); }
catch (e) {
  if (/不能为空/.test(e.message)) showFieldError('smsCode','请输入短信验证码');
  else handleError(e);
}

Prevention

When it happens

Trigger: POST to /login/mobile where the 'smsCode' form/query parameter is missing or empty.

Common situations: Frontend omitted smsCode; field misnamed; SMS never received so left blank.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/acd39adf2fcdf761. Report an issue: GitHub.