background:
The security department issued a document stating that the verification code for our platform login is at risk of brute force cracking. Take a look immediately:
漏洞风险等级：低危
涉及页面及url：http://xxxx.com/#/login
涉及参数：--
漏洞描述：登陆界面由于验证码不失效，导致可以暴力破解，但破解得到的账户无法登录。
修复建议：后台设置验证码使用一次失效 deal with:
Mainly do 2 points: First, refresh the verification code if the login fails. The second is that the back-end service will invalidate the verification code of the login failure regardless of success or failure after verification.
I sorted out the process, and the steps in red are suggested improvements.
https://www.processon.com/view/link/5ed7608e0791291d5dbf517f
