wuyouzhuguli/SpringAll · error · ValidateCodeException

验证码不存在！

Error message

验证码不存在！

What it means

Thrown when sessionStrategy.getAttribute returns null for SESSION_KEY_IMAGE_CODE, meaning no ImageCode was ever stored in the HTTP session for this client. The captcha must first be generated via GET /code/image (ValidateController.createCode) which writes the code into the same session, then submitted on login.

Source

Thrown at 61.Spring-security-Permission/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:51

            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

1. Always load GET /code/image in the same browser session immediately before submitting login, and reuse the same JSESSIONID cookie.
2. Verify the JSESSIONID cookie is present and identical on both the /code/image and the login requests (check DevTools Network).
3. In a clustered deployment, enable Spring Session + Redis (or sticky sessions) so the captcha is visible to every node.
4. Raise server session timeout if users sit on the login page a long time before the captcha is fetched.

// Ensure a captcha was generated in this session before allowing submit.
const hasImage = sessionStorage.getItem('captchaFetched');
if (!hasImage) { await refreshCaptcha(); }
// refreshCaptcha does: fetch('/code/image', { credentials:'same-origin' }) then sets the flag
form.addEventListener('submit', ...)

try { await login(); }
catch (e) {
  if (/验证码不存在/.test(e.message)) { await refreshCaptcha(); retry(); }
  else handleError(e);
}

When it happens

Trigger: Login POST is sent without first GETting /code/image in the same session; the JSESSIONID cookie differs between the /code/image request and the login request; the session expired on the server; a previous successful/failed login already consumed the code (note: successful login path removes it only on match, but session invalidation on login can also drop it).

Common situations: Browser blocked third-party/SameSite cookies so a fresh session was created for the login call; load-balanced cluster without session affinity (sticky session) or without Spring Session shared store; incognito/new tab where the captcha image was fetched in another session; server restart with in-memory sessions.

Related errors

• 验证码不存在！
• 验证码不存在！
• 验证码不存在！
• 验证码不存在！
• 验证码不存在！

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/b957538723d83c56. Report an issue: GitHub.