wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码已过期！

Error message

验证码已过期！

What it means

ValidateCodeException from the image-captcha ValidateCodeFilter in module 38 when the session ImageCode is present but expired (isExpire() true). The filter removes the stale attribute, then throws, requiring a fresh captcha.

Source

Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:55

                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Refresh the captcha image and resubmit promptly.
  2. Increase expireIn (seconds) in the captcha-generation config.
  3. Auto-refresh the image when it goes stale.
  4. Show the code's remaining lifetime to the user.

Example fix

// before
imageCode.setExpireTime(LocalDateTime.now().plusSeconds(30));

// after
imageCode.setExpireTime(LocalDateTime.now().plusSeconds(180));
Defensive patterns

Strategy: retry

Validate before calling

// client-side: refresh the captcha and track its lifetime
function refreshCaptcha() {
    document.getElementById('captchaImg').src = '/code/image?t=' + Date.now();
    captchaGeneratedAt = Date.now();
}
if (Date.now() - captchaGeneratedAt > TTL_MS) refreshCaptcha();

Prevention

When it happens

Trigger: POST to login with a present imageCode whose age exceeds the configured expireIn window.

Common situations: User lingered past the captcha TTL; expireIn configured too short; slow submit.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/ef0ac47344f6d3aa. Report an issue: GitHub.