{"record":{"id":"a081b072d25ebe11","repo":"spring-projects/spring-security","slug":"the-request-was-rejected-because-the-parameter-nam","errorCode":null,"errorMessage":"The request was rejected because the parameter name \\\"\" + name + \"\\\" is not allowed.","messagePattern":"The request was rejected because the parameter name \\\\\"\" \\+ name \\+ \"\\\\\" is not allowed\\.","errorType":"exception","errorClass":"RequestRejectedException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java","lineNumber":850,"sourceCode":"\t\t}\n\n\t\tprivate void validateAllowedHeaderName(String headerNames) {\n\t\t\tif (!StrictHttpFirewall.this.allowedHeaderNames.test(headerNames)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the header name \\\"\" + headerNames + \"\\\" is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateAllowedHeaderValue(String name, String value) {\n\t\t\tif (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) {\n\t\t\t\tthrow new RequestRejectedException(\"The request was rejected because the header: \\\"\" + name\n\t\t\t\t\t\t+ \" \\\" has a value \\\"\" + value + \"\\\" that is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateAllowedParameterName(String name) {\n\t\t\tif (!StrictHttpFirewall.this.allowedParameterNames.test(name)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the parameter name \\\"\" + name + \"\\\" is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\tprivate void validateAllowedParameterValue(String name, String value) {\n\t\t\tif (!StrictHttpFirewall.this.allowedParameterValues.test(value)) {\n\t\t\t\tthrow new RequestRejectedException(\"The request was rejected because the parameter: \\\"\" + name\n\t\t\t\t\t\t+ \" \\\" has a value \\\"\" + value + \"\\\" that is not allowed.\");\n\t\t\t}\n\t\t}\n\n\t\t@Override\n\t\tpublic void reset() {\n\t\t}\n\n\t};\n\n}","sourceCodeStart":832,"sourceCodeEnd":868,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java#L832-L868","documentation":"StrictHttpFirewall checks every request parameter name against the allowedParameterNames predicate. A parameter name that fails the test causes the request to be rejected with RequestRejectedException before reaching the filter chain. By default the predicate only blocks empty names, so this is usually triggered by custom configuration or names containing control characters.","triggerScenarios":"A request carries a query/form parameter whose name fails StrictHttpFirewall's allowedParameterNames predicate — e.g. after configuring a restricted set of parameter names, or when the name contains non-printable characters.","commonSituations":"Teams restricting allowed parameter names but forgetting ones the app actually uses; clients encoding control characters into parameter names; third-party callbacks sending unexpected parameters after a firewall lockdown.","solutions":["Check the rejected parameter name in the exception and confirm the client should be sending it.","Update the allowedParameterNames predicate via StrictHttpFirewall.setAllowedParameterNames(Predicate<String>) to permit the required name.","Remove or fix the client-side code that sends the offending parameter name.","Keep the default predicate (non-blank names) unless you have a strong reason to restrict further."],"exampleFix":"// before\nStrictHttpFirewall firewall = new StrictHttpFirewall();\nfirewall.setAllowedParameterNames(Pattern.compile(\"^[a-zA-Z]+$\")::asMatchPredicate);\n// after\nStrictHttpFirewall firewall = new StrictHttpFirewall();\nfirewall.setAllowedParameterNames(Pattern.compile(\"^(?!.*[__])[\\w-]+$\")::asMatchPredicate);","handlingStrategy":"validation","validationCode":"// Java client-side guard\nif (paramName == null || paramName.isBlank() || !paramName.chars().allMatch(c -> c > 0x20)) {\n    throw new IllegalArgumentException(\"Invalid parameter name: \" + paramName);\n}","typeGuard":null,"tryCatchPattern":"try {\n    return chain.filter(exchange);\n} catch (RequestRejectedException e) {\n    log.warn(\"Rejected parameter name: {}\", e.getMessage());\n    response.setStatusCode(HttpStatus.BAD_REQUEST);\n    return response.setComplete();\n}","preventionTips":["Keep parameter names limited to [A-Za-z0-9_-]","Avoid dynamically generated parameter names from user input","Review firewall parameter-name predicates after adding new endpoints","Log and audit rejected requests"],"tags":["spring-security","http-firewall","request-rejected","parameter-name"],"backgroundTag":"invalid-argument-value","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}