wuyouzhuguli/SpringAll · error · ValidateCodeException

验证码不能为空！

Error message

验证码不能为空！

What it means

ValidateCodeException thrown by SmsCodeFilter.validateCode (project 61) when the 'smsCode' request parameter is blank. This filter guards /login/mobile before SmsAuthenticationFilter runs. BUG NOTE: the next line reads the 'mobile' param as ServletRequestUtils.getStringParameter(..., "smsCode") again, so mobileInRequest is wrong downstream.

Source

Thrown at 61.Spring-security-Permission/src/main/java/cc/mrbird/validate/smscode/SmsCodeFilter.java:51

                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        String smsCodeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");
        String mobileInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "smsCode");

        SmsCode codeInSession = (SmsCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_SMS_CODE + mobileInRequest);

        if (StringUtils.isBlank(smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), smsCodeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }
}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Include a non-empty 'smsCode' parameter in the /login/mobile POST body.
  2. Confirm the frontend input is bound to the key 'smsCode' (not 'code' or 'verifyCode').
  3. Also fix the companion bug: change the second getStringParameter to read 'mobile' so downstream session-key lookup is correct (see error 67).

Example fix

// before
// String mobileInRequest = ServletRequestUtils.getStringParameter(req, "smsCode"); // wrong key

// after
String mobileInRequest = ServletRequestUtils.getStringParameter(req, "mobile");
Defensive patterns

Strategy: validation

Validate before calling

// Validate the SMS code field before submit.
const code = form.get('smsCode');
if (!code || !code.trim()) { showFieldError('smsCode','请输入短信验证码'); return; }

Try / catch

try { await smsLogin(); }
catch (e) {
  if (/不能为空/.test(e.message)) showFieldError('smsCode','请输入短信验证码');
  else handleError(e);
}

Prevention

When it happens

Trigger: POST to /login/mobile where the 'smsCode' form/query parameter is missing or empty. The blank check runs before the Redis/session lookup.

Common situations: Frontend omitted the smsCode field; field named 'code' instead of 'smsCode'; SMS code never arrived so the field was left empty.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/e6320c6ebd58de7d. Report an issue: GitHub.