Is it safe for java to store the verification code in the session? Will it be intercepted?

The session is on the server side, so there is no need to worry about being intercepted.

Create a session for the current request, and put the verification code in the session according to your security policy. For example, record the IP address of the current request, record the current mobile phone number and the number of times the verification code has been sent. At each request, obtain the information in the current session and make logical judgments;

Another idea is to put the mobile phone number and other information in the redis cache, or in your DB, so that it will not be closed due to browsing server (session loss), resulting in the loss of previously recorded mobile phone number and other information