{"record":{"id":"a1c7b84376bc21ba","repo":"spring-projects/spring-security","slug":"the-request-was-rejected-because-the-url-contained","errorCode":null,"errorMessage":"The request was rejected because the URL contained a potentially malicious String \\\"\" + forbidden + \"\\\"","messagePattern":"The request was rejected because the URL contained a potentially malicious String \\\\\"\" \\+ forbidden \\+ \"\\\\\"","errorType":"exception","errorClass":"RequestRejectedException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java","lineNumber":548,"sourceCode":"\t\t\t\t.format(\"The %s was rejected because it can only contain printable ASCII characters.\", propertyName));\n\t\t}\n\t}\n\n\tprivate void rejectForbiddenHttpMethod(HttpServletRequest request) {\n\t\tif (this.allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {\n\t\t\treturn;\n\t\t}\n\t\tif (!this.allowedHttpMethods.contains(request.getMethod())) {\n\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\"The request was rejected because the HTTP method \\\"\" + request.getMethod()\n\t\t\t\t\t\t\t+ \"\\\" was not included within the list of allowed HTTP methods \" + this.allowedHttpMethods);\n\t\t}\n\t}\n\n\tprivate void rejectedBlocklistedUrls(HttpServletRequest request) {\n\t\tfor (String forbidden : this.encodedUrlBlocklist) {\n\t\t\tif (encodedUrlContains(request, forbidden)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the URL contained a potentially malicious String \\\"\"\n\t\t\t\t\t\t\t\t+ forbidden + \"\\\"\");\n\t\t\t}\n\t\t}\n\t\tfor (String forbidden : this.decodedUrlBlocklist) {\n\t\t\tif (decodedUrlContains(request, forbidden)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the URL contained a potentially malicious String \\\"\"\n\t\t\t\t\t\t\t\t+ forbidden + \"\\\"\");\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate void rejectedUntrustedHosts(HttpServletRequest request) {\n\t\tString serverName = request.getServerName();\n\t\tif (serverName != null && !this.allowedHostnames.test(serverName)) {\n\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\"The request was rejected because the domain \" + serverName + \" is untrusted.\");","sourceCodeStart":530,"sourceCodeEnd":566,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java#L530-L566","documentation":"StrictHttpFirewall's rejectedBlocklistedUrls() scans the request URL (both the encoded and decoded forms) against configured blocklists of known-exploit strings such as path traversal ('../', './'), double dot variants, ';;', and URL-encoding tricks. This RequestRejectedException fires when the request URL contains one of these blocklisted sequences, indicating a likely path traversal or URL-manipulation attack, and the firewall rejects the request before it reaches the filter chain.","triggerScenarios":"Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:548 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Fix or reject the offending client request; the URL contains a blocklisted sequence like '../', ';;' or an encoded variant","If a legitimate URL is blocked, adjust the blocklists via setEncodedUrlBlocklist/setDecodedUrlBlocklist (remove only what is safe for your app)","Normalize/encode client-side URLs so no traversal or encoded-malware patterns are sent"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}