wuyouzhuguli/SpringAll · warning · ValidateCodeException
验证码不能为空！
Error message
验证码不能为空！
What it means
ValidateCodeException from the image-captcha ValidateCodeFilter inside module 38.Spring-Security-SmsCode. This branch fires when the submitted imageCode request parameter is null or blank. The filter catches it and routes it to authenticationFailureHandler before the SMS login flow proceeds.
Solutions
- Add <input type="text" name="imageCode"> to the login form and submit a non-empty value.
- Confirm the request parameter name matches the filter's getStringParameter(...,"imageCode").
- Add client-side required-field validation before submit.
- In tests, always include a non-empty imageCode parameter.
Example fix
// before <input name="username"/> <input name="password"/> <!-- imageCode field missing --> // after <input name="username"/> <input name="password"/> <input type="text" name="imageCode" required/>
Defensive patterns
Strategy: validation
Validate before calling
// front-end guard before submitting the login form
if (!form.imageCode || form.imageCode.trim() === '') {
showError('请输入图形验证码');
return;
}
form.submit(); Prevention
- Mark the captcha input required and disable submit until filled.
- Match the form field name attribute exactly to the parameter the filter reads ('imageCode').
- Include a non-empty imageCode in every login integration test.
When it happens
Trigger: POST to the configured image-login URL with the imageCode form field missing, empty, or whitespace-only.
Common situations: Login form omits the imageCode input; field name attribute is not 'imageCode'; test client does not send imageCode; the SMS-focused demo neglected the image-captcha field.
Related errors
AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14).
Data as JSON: /api/errors/ff28429f99836023.
Report an issue: GitHub.
Appendix: source
Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:48
protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
if (StringUtils.equalsIgnoreCase("/login", httpServletRequest.getRequestURI())
&& StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
try {
validateCode(new ServletWebRequest(httpServletRequest));
} catch (ValidateCodeException e) {
authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
return;
}
}
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");
if (StringUtils.isBlank(codeInRequest)) {
throw new ValidateCodeException("验证码不能为空！");
}
if (codeInSession == null) {
throw new ValidateCodeException("验证码不存在！");
}
if (codeInSession.isExpire()) {
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
throw new ValidateCodeException("验证码已过期！");
}
if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
throw new ValidateCodeException("验证码不正确！");
}
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
}
}
View on GitHub (pinned to 614d2578d9)