Redis SMS verification code

The session is on the server, so don't worry about being intercepted.

Create a session for the current request, and put the verification code into the session according to your security policy, such as recording the IP address of the current request, recording the current mobile phone number and the number of times to send the verification code. Every time a request is made, the information in the current session is obtained and a logical judgment is made;

Another idea is to put the information such as mobile phone number in redis cache or your DB, so that the previously recorded information such as mobile phone number will not be lost (session loss) because of closing the browser.