wuyouzhuguli/SpringAll · warning · ValidateCodeException
验证码不能为空！
Error message
验证码不能为空！
What it means
ValidateCodeException from the image-captcha ValidateCodeFilter inside module 38.Spring-Security-SmsCode. This branch fires when the submitted imageCode request parameter is null or blank. The filter catches it and routes it to authenticationFailureHandler before the SMS login flow proceeds.
Source
Thrown at 38.Spring-Security-SmsCode/src/main/java/cc/mrbird/validate/code/ValidateCodeFilter.java:48
protected void doFilterInternal(HttpServletRequest httpServletRequest, HttpServletResponse httpServletResponse, FilterChain filterChain) throws ServletException, IOException {
if (StringUtils.equalsIgnoreCase("/login", httpServletRequest.getRequestURI())
&& StringUtils.equalsIgnoreCase(httpServletRequest.getMethod(), "post")) {
try {
validateCode(new ServletWebRequest(httpServletRequest));
} catch (ValidateCodeException e) {
authenticationFailureHandler.onAuthenticationFailure(httpServletRequest, httpServletResponse, e);
return;
}
}
filterChain.doFilter(httpServletRequest, httpServletResponse);
}
private void validateCode(ServletWebRequest servletWebRequest) throws ServletRequestBindingException {
ImageCode codeInSession = (ImageCode) sessionStrategy.getAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
String codeInRequest = ServletRequestUtils.getStringParameter(servletWebRequest.getRequest(), "imageCode");
if (StringUtils.isBlank(codeInRequest)) {
throw new ValidateCodeException("验证码不能为空！");
}
if (codeInSession == null) {
throw new ValidateCodeException("验证码不存在！");
}
if (codeInSession.isExpire()) {
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
throw new ValidateCodeException("验证码已过期！");
}
if (!StringUtils.equalsIgnoreCase(codeInSession.getCode(), codeInRequest)) {
throw new ValidateCodeException("验证码不正确！");
}
sessionStrategy.removeAttribute(servletWebRequest, ValidateController.SESSION_KEY_IMAGE_CODE);
}
}
View on GitHub (pinned to 614d2578d9)
Solutions
- Add <input type="text" name="imageCode"> to the login form and submit a non-empty value.
- Confirm the request parameter name matches the filter's getStringParameter(...,"imageCode").
- Add client-side required-field validation before submit.
- In tests, always include a non-empty imageCode parameter.
Example fix
// before <input name="username"/> <input name="password"/> <!-- imageCode field missing --> // after <input name="username"/> <input name="password"/> <input type="text" name="imageCode" required/>
Defensive patterns
Strategy: validation
Validate before calling
// front-end guard before submitting the login form
if (!form.imageCode || form.imageCode.trim() === '') {
showError('请输入图形验证码');
return;
}
form.submit(); Prevention
- Mark the captcha input required and disable submit until filled.
- Match the form field name attribute exactly to the parameter the filter reads ('imageCode').
- Include a non-empty imageCode in every login integration test.
When it happens
Trigger: POST to the configured image-login URL with the imageCode form field missing, empty, or whitespace-only.
Common situations: Login form omits the imageCode input; field name attribute is not 'imageCode'; test client does not send imageCode; the SMS-focused demo neglected the image-captcha field.
Related errors
AI-assisted analysis of wuyouzhuguli/SpringAll@614d2578d9 (2026-08-14).
Data as JSON: /api/errors/ff28429f99836023.
Report an issue: GitHub.