wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不能为空！

Error message

验证码不能为空！

What it means

ValidateCodeException thrown by SmsCodeFilter.validateCode() (module 38) when the submitted smsCode request parameter is null or blank. This filter runs before /login/mobile; on failure it delegates to authenticationFailureHandler. Note the filter reads the parameter named 'smsCode' here, so the form field must be named exactly that.

Source

Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:51

                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Add <input type="text" name="smsCode"> to the mobile login form and submit a non-empty value.
  2. Confirm the request parameter name matches the filter's getStringParameter(...,"smsCode").
  3. Add client-side required-field validation before submit.
  4. In tests, always include a non-empty smsCode parameter.

Example fix

// before
<form action="/login/mobile" method="post">
  <input name="mobile"/>
  <!-- smsCode field missing -->
</form>

// after
<form action="/login/mobile" method="post">
  <input name="mobile"/>
  <input type="text" name="smsCode" required/>
</form>
Defensive patterns

Strategy: validation

Validate before calling

// front-end guard before submitting the mobile login form
if (!form.smsCode || form.smsCode.trim() === '') {
    showError('请输入短信验证码');
    return;
}
form.submit();

Prevention

When it happens

Trigger: POST to /login/mobile with the smsCode form field missing, empty, or whitespace-only.

Common situations: Form omits the smsCode input; field name is not 'smsCode' (e.g., 'code'); test client does not send smsCode; the SMS code was never entered.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/d4a73059cae1631f. Report an issue: GitHub.