{"record":{"id":"9bfa415add78f736","repo":"spring-projects/spring-security","slug":"the-request-was-rejected-because-the-parameter-9bfa41","errorCode":null,"errorMessage":"The request was rejected because the parameter: \"<name> \" has a value \"<value>\" that is not allowed.","messagePattern":"The request was rejected because the parameter: \"<name> \" has a value \"<value>\" that is not allowed\\.","errorType":"exception","errorClass":"ServerExchangeRejectedException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewall.java","lineNumber":656,"sourceCode":"\t}\n\n\tprivate void validateAllowedHeaderValue(Object key, @Nullable String value) {\n\t\tif (!StrictServerWebExchangeFirewall.this.allowedHeaderValues.test(value)) {\n\t\t\tthrow new ServerExchangeRejectedException(\"The request was rejected because the header: \\\"\" + key\n\t\t\t\t\t+ \" \\\" has a value \\\"\" + value + \"\\\" that is not allowed.\");\n\t\t}\n\t}\n\n\tprivate void validateAllowedParameterName(String name) {\n\t\tif (!StrictServerWebExchangeFirewall.this.allowedParameterNames.test(name)) {\n\t\t\tthrow new ServerExchangeRejectedException(\n\t\t\t\t\t\"The request was rejected because the parameter name \\\"\" + name + \"\\\" is not allowed.\");\n\t\t}\n\t}\n\n\tprivate void validateAllowedParameterValue(String name, String value) {\n\t\tif (!StrictServerWebExchangeFirewall.this.allowedParameterValues.test(value)) {\n\t\t\tthrow new ServerExchangeRejectedException(\"The request was rejected because the parameter: \\\"\" + name\n\t\t\t\t\t+ \" \\\" has a value \\\"\" + value + \"\\\" that is not allowed.\");\n\t\t}\n\t}\n\n\tprivate static boolean encodedUrlContains(ServerHttpRequest request, String value) {\n\t\tif (valueContains(request.getPath().value(), value)) {\n\t\t\treturn true;\n\t\t}\n\t\treturn valueContains(request.getURI().getRawPath(), value);\n\t}\n\n\tprivate static boolean decodedUrlContains(ServerHttpRequest request, String value) {\n\t\treturn valueContains(request.getURI().getPath(), value);\n\t}\n\n\tprivate static boolean containsOnlyPrintableAsciiCharacters(String uri) {\n\t\tif (uri == null) {\n\t\t\treturn true;","sourceCodeStart":638,"sourceCodeEnd":674,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/server/firewall/StrictServerWebExchangeFirewall.java#L638-L674","documentation":"StrictServerWebExchangeFirewall validates every request parameter value against the configured allowedParameterValues predicate. When a parameter value fails the predicate, the firewall rejects the whole exchange with ServerExchangeRejectedException before the request reaches any handler. This is Spring Security's strict-mode blocklist/allowlist mechanism for parameter values (e.g. blocking encoded attacks).","triggerScenarios":"A request arrives containing a query or form parameter whose value does not pass the Predicate<String> configured via StrictServerWebExchangeFirewall/ServerHttpSecurity .requestCache()/.parameterValue allowlist customization (or the default allowed set). Any endpoint receives a parameter value outside the allowlist.","commonSituations":"Developers tighten the firewall with a strict allowedParameterValues predicate and forget legitimate values (e.g. values containing encoded characters, commas, or special tokens); clients send values the allowlist wasn't updated for after a feature change; security scans/bots send malicious parameter values.","solutions":["Inspect the rejected parameter name/value in the exception message and either fix the client to send allowed values","Extend the allowedParameterValues predicate to permit the legitimate value (e.g. add to the allowlist or relax the test)","If the request is malicious/unexpected, keep the rejection and investigate the client","Temporarily log rejected values via the rejected handler to tune the allowlist before relaxing it"],"exampleFix":"// before\nhttp.protocolLogin(...) ; firewall allowing only [\"a\",\"b\"]\n.parameterValue(value -> value.in(\"a\",\"b\"))\n// after\n.parameterValue(value -> value.in(\"a\",\"b\",\"c\") || value.matches(\"[a-z0-9-]+\"))","handlingStrategy":"validation","validationCode":"// client-side check before sending\nif (!allowedValues.contains(paramValue)) {\n    throw new IllegalArgumentException(\"Value not allowed for parameter \" + paramName);\n}","typeGuard":null,"tryCatchPattern":"// server-side: reject with 400, never leak internals\ntry {\n    return chain.filter(exchange);\n} catch (ServerExchangeRejectedException ex) {\n    response.setStatusCode(HttpStatus.BAD_REQUEST);\n    return response.setComplete();\n}","preventionTips":["Keep the allowedParameterValues allowlist in config alongside the feature that introduces new parameter values","Log rejected parameter values (name only + sanitized value) to detect allowlist gaps","Add integration tests that send every parameter your API documents"],"tags":["spring-security","request-firewall","input-validation"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}