wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不正确！

Error message

验证码不正确！

What it means

Thrown by ValidateCodeFilter.validateCode when the submitted imageCode request parameter does not case-insensitively equal the code stored in session (StringUtils.equalsIgnoreCase fails). This is the mismatch gate after the empty/null/expired checks pass. Raised as ValidateCodeException and routed to AuthenticationFailureHandler, and the consumed code is then removed from session.

Source

Thrown at 59.Spring-Security-SessionManager/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:58

        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Tell the user to re-type the code exactly as shown and reload a fresh image.
  2. Ensure the front-end submits the raw code with no extra whitespace/trimming that diverges from the stored value.
  3. Refresh the captcha image before resubmitting so the session code and displayed code match.
  4. If the image is frequently misread, tune the generateCode (more length/clearer font) in ValidateController.

Example fix

// before
formData.append("imageCode", userGuess);

// after
// re-fetch a fresh image first, then submit the exact displayed code
refreshCaptcha().then(() => formData.append("imageCode", exactDisplayedCode));
Defensive patterns

Strategy: validation

Validate before calling

// client-side: trim and require exact 4-digit code before submit
const code = (form.get('imageCode') || '').trim();
if (!/^\d{4}$/.test(code)) { showError('验证码格式不正确'); return; }

Try / catch

// AuthenticationFailureHandler: on mismatch, refresh image and ask to retry.

Prevention

When it happens

Trigger: The user mistyped the captcha; the image was ambiguous; OCR misread; or the submitted code belongs to a previously-refreshed captcha whose session entry was already replaced.

Common situations: Hard-to-read generated digits; stale captcha image still shown after a refresh; case/whitespace handling differences (note the comparison is trimmed only by the form, not here).

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/dff958e223f04564. Report an issue: GitHub.