wuyouzhuguli/SpringAll · warning · ValidateCodeException
验证码不能为空！
Error message
验证码不能为空！
What it means
Identical ValidateCodeException logic to the other modules, here in the 37.Spring-Security-RememberMe image-captcha filter. This branch fires when the submitted imageCode request parameter is null or blank. The filter routes the exception to authenticationFailureHandler, blocking the login/remember-me flow.
Source
Thrown at 37.Spring-Security-RememberMe/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:48
protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
if (StringUtils.equalsIgnoreCase("/login", httpServletRequest.getRequestURI())
&& StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
try {
validateCode(new ServletWebRequest(httpServletRequest));
} catch (ValidateCodeException e) {
authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
return;
}
}
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");
if (StringUtils.isBlank(codeInRequest)) {
throw new ValidateCodeException("验证码不能为空！");
}
if (codeInSession == null) {
throw new ValidateCodeException("验证码不存在！");
}
if (codeInSession.isExpire()) {
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
throw new ValidateCodeException("验证码已过期！");
}
if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
throw new ValidateCodeException("验证码不正确！");
}
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
}
}
View on GitHub (pinned to 614d2578d9)
Solutions
- Add <input type="text" name="imageCode"> to the login form and submit a non-empty value.
- Confirm the request parameter name matches the filter's getStringParameter(...,"imageCode").
- Add client-side required-field validation before submit.
- In tests, always include a non-empty imageCode parameter.
Example fix
// before <input name="username"/> <input name="password"/> <input type="checkbox" name="remember-me"/> <!-- imageCode field missing --> // after <input name="username"/> <input name="password"/> <input type="text" name="imageCode" required/> <input type="checkbox" name="remember-me"/>
Defensive patterns
Strategy: validation
Validate before calling
// front-end guard before submitting the remember-me login form
if (!form.imageCode || form.imageCode.trim() === '') {
showError('请输入图形验证码');
return;
}
form.submit(); Prevention
- When adding remember-me to an existing form, re-verify the captcha field is still present and named 'imageCode'.
- Mark the captcha input required and disable submit until filled.
- Include a non-empty imageCode in every login integration test.
When it happens
Trigger: POST to the login URL in the RememberMe demo with the imageCode form field missing, empty, or whitespace-only.
Common situations: Login form omits the imageCode input (common when remember-me was bolted onto an older form); field name attribute is not 'imageCode'; test client does not send imageCode.
Related errors
AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14).
Data as JSON: /api/errors/b3ab91b7c2f1a135.
Report an issue: GitHub.