{"record":{"id":"48342e7f6c003785","repo":"spring-projects/spring-security","slug":"the-request-was-rejected-because-the-header-name","errorCode":null,"errorMessage":"The request was rejected because the header name \\\"\" + headerNames + \"\\\" is not allowed.","messagePattern":"The request was rejected because the header name \\\\\"\" \\+ headerNames \\+ \"\\\\\" is not allowed\\.","errorType":"exception","errorClass":"RequestRejectedException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java","lineNumber":836,"sourceCode":"\t\t}\n\n\t\t@Override\n\t\tpublic String[] getParameterValues(String name) {\n\t\t\tif (name != null) {\n\t\t\t\tvalidateAllowedParameterName(name);\n\t\t\t}\n\t\t\tString[] values = super.getParameterValues(name);\n\t\t\tif (values != null) {\n\t\t\t\tfor (String value : values) {\n\t\t\t\t\tvalidateAllowedParameterValue(name, value);\n\t\t\t\t}\n\t\t\t}\n\t\t\treturn values;\n\t\t}\n\n\t\tprivate void validateAllowedHeaderName(String headerNames) {\n\t\t\tif (!StrictHttpFirewall.this.allowedHeaderNames.test(headerNames)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the header name \\\"\" + headerNames + \"\\\" is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateAllowedHeaderValue(String name, String value) {\n\t\t\tif (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) {\n\t\t\t\tthrow new RequestRejectedException(\"The request was rejected because the header: \\\"\" + name\n\t\t\t\t\t\t+ \" \\\" has a value \\\"\" + value + \"\\\" that is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateAllowedParameterName(String name) {\n\t\t\tif (!StrictHttpFirewall.this.allowedParameterNames.test(name)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the parameter name \\\"\" + name + \"\\\" is not allowed.\");\n\t\t\t}\n\t\t}\n","sourceCodeStart":818,"sourceCodeEnd":854,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java#L818-L854","documentation":"StrictHttpFirewall's StrictFirewalledRequest validates every header name accessed through the wrapped request against the allowedHeaderNames predicate. This RequestRejectedException fires when a header name contains characters outside the allowed set — for example non-printable ASCII, CR/LF, or other control characters — which would indicate header-injection or smuggling attempts. The firewall rejects the request rather than exposing the malicious header to the application.","triggerScenarios":"Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:836 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Locate and fix the client/proxy sending headers with illegal characters (control chars, CR/LF) in their names","If a legitimate custom header is blocked, widen allowedHeaderNames via setAllowedHeaderNames(Predicate) with a safe pattern","Reject such requests at the reverse proxy before they reach the application"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}