wuyouzhuguli/SpringAll · warning · ValidateCodeException

验证码不能为空！

Error message

验证码不能为空！

What it means

ValidateCodeException is a custom RuntimeException (cc.mrbird.validate.code.ValidateCodeException). ValidateCodeFilter.validateCode() runs before the login POST in the Spring Security filter chain; this branch fires when the submitted imageCode request parameter is null or blank (StringUtils.isBlank). The filter's doFilter catches it and routes it to authenticationFailureHandler, so authentication never proceeds.

Source

Thrown at 36.Spring-Security-ValidateCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:48

    protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
        if (StringUtils.equalsIgnoreCase("/login", httpServletRequest.getRequestURI())
                && StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
            try {
                validateCode(new ServletWebRequest(httpServletRequest));
            } catch (ValidateCodeException e) {
                authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
                return;
            }
        }
        filterChain.doFilter(httpServletRequest, httpServletResponse);
    }

    private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
        ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
        String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");

        if (StringUtils.isBlank(codeInRequest)) {
            throw new ValidateCodeException("验证码不能为空！");
        }
        if (codeInSession == null) {
            throw new ValidateCodeException("验证码不存在！");
        }
        if (codeInSession.isExpire()) {
            sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
            throw new ValidateCodeException("验证码已过期！");
        }
        if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
            throw new ValidateCodeException("验证码不正确！");
        }
        sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);

    }

}

View on GitHub (pinned to 614d2578d9)

Solutions

  1. Add <input type="text" name="imageCode"> to the login form and submit a non-empty value.
  2. Confirm the request parameter name matches the filter's getStringParameter(...,"imageCode").
  3. Add client-side required-field validation to block empty submission before the request.
  4. In integration tests, always include a non-empty imageCode parameter.

Example fix

// before
<form method="post" action="/authentication/form">
  <input name="username"/>
  <input name="password"/>
  <!-- captcha field missing -->
</form>

// after
<form method="post" action="/authentication/form">
  <input name="username"/>
  <input name="password"/>
  <input type="text" name="imageCode" required/>
</form>
Defensive patterns

Strategy: validation

Validate before calling

// front-end guard before submitting the login form
if (!form.imageCode || form.imageCode.trim() === '') {
    showError('请输入图形验证码');
    return;
}
form.submit();

Prevention

When it happens

Trigger: POST to the configured login URL with the imageCode form field missing, empty, or whitespace-only.

Common situations: The login form omits the imageCode input; the field's name attribute differs from 'imageCode'; an automated test/curl client does not send imageCode; a copy-pasted form dropped the captcha field.

Related errors

AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14). Data as JSON: /api/errors/f634f07de954b36e. Report an issue: GitHub.