wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不存在！

Error message

验证码不存在！

What it means

Same ValidateCodeException thrown by ValidateCodeFilter.validateCode(). This branch fires when the captcha stored in the HTTP session (ImageCode under ValidateController.SESSION_KEY_IMAGE_CODE) is null, i.e., no captcha was ever generated for this session or it was already removed/expired. It indicates a session-state problem, not a user typo.

Source

Thrown at 36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:51

            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

1. Ensure the browser requests the captcha image (GET /code/image) before submitting login, in the same session.
2. Verify cookies (JSESSIONID) are accepted and sent on both requests; check SameSite/secure flags.
3. For clustered deployments, use a shared session store (Redis) or sticky sessions so generation and login share state.
4. Check session timeout (server.servlet.session.timeout) is long enough for user input.

Example fix

// before: client requests only the login POST
POST /authentication/form  imageCode=ABCD   // session has no ImageCode -> 不存在

// after: client fetches the captcha image first, same JSESSIONID
GET  /code/image           // sets session ImageCode
POST /authentication/form  imageCode=ABCD   // Cookie: JSESSIONID=...

// ensure a captcha exists in this session before allowing submit
fetch('/code/image', { credentials: 'same-origin' })
  .then(() => enableLoginForm());

When it happens

Trigger: POST to login with a non-empty imageCode but no matching ImageCode object in the session - the user never requested GET /code/image, or the session that generated the captcha differs from the session submitting the form.

Common situations: Browser blocked the JSESSIONID cookie so each request is a new session; captcha image endpoint /code/image was never hit; session timed out between rendering the form and submitting; load balancer without sticky sessions routes generation and login to different nodes; the captcha was already consumed/removed by a previous submit.

Related errors

• 验证码不存在！
• 验证码不存在！
• 验证码不存在！
• 验证码已过期！
• 验证码不存在！

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/d86878017af706b5. Report an issue: GitHub.