wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

Thrown by ValidateCodeFilter.validateCode (Logout project) when the submitted imageCode does not case-insensitively match the session code (the mismatch gate). The consumed code is removed from session afterward.

Source

Thrown at 60.Spring-Security-Logout/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:58

        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Re-type the code exactly and reload a fresh image.
  2. Submit the raw displayed code without divergent trimming.
  3. Refresh the captcha before resubmitting.
  4. Tune generateCode for readability if mismatches are frequent.

Example fix

// before
formData.append("imageCode", userGuess);

// after
refreshCaptcha().then(() => formData.append("imageCode", exactDisplayedCode));
Defensive patterns

Strategy: validation

Validate before calling

// client-side: trim and validate 4-digit code
const code = (form.get('imageCode') || '').trim();
if (!/^\d{4}$/.test(code)) { showError('验证码格式不正确'); return; }

Try / catch

// AuthenticationFailureHandler: on mismatch, refresh image and retry.

Prevention

When it happens

Trigger: User mistyped the captcha; stale captcha image displayed after a refresh; OCR/case differences.

Common situations: Ambiguous generated digits; mismatched displayed vs. stored code; whitespace differences.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/cc230107a0c74cff. Report an issue: GitHub.