{"record":{"id":"a48993cdfa6af5e2","repo":"spring-projects/spring-security","slug":"the-request-was-rejected-because-the-domain-se","errorCode":null,"errorMessage":"The request was rejected because the domain \" + serverName + \" is untrusted.","messagePattern":"The request was rejected because the domain \" \\+ serverName \\+ \" is untrusted\\.","errorType":"exception","errorClass":"RequestRejectedException","httpStatus":400,"severity":"error","filePath":"web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java","lineNumber":565,"sourceCode":"\t\t\tif (encodedUrlContains(request, forbidden)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the URL contained a potentially malicious String \\\"\"\n\t\t\t\t\t\t\t\t+ forbidden + \"\\\"\");\n\t\t\t}\n\t\t}\n\t\tfor (String forbidden : this.decodedUrlBlocklist) {\n\t\t\tif (decodedUrlContains(request, forbidden)) {\n\t\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\t\"The request was rejected because the URL contained a potentially malicious String \\\"\"\n\t\t\t\t\t\t\t\t+ forbidden + \"\\\"\");\n\t\t\t}\n\t\t}\n\t}\n\n\tprivate void rejectedUntrustedHosts(HttpServletRequest request) {\n\t\tString serverName = request.getServerName();\n\t\tif (serverName != null && !this.allowedHostnames.test(serverName)) {\n\t\t\tthrow new RequestRejectedException(\n\t\t\t\t\t\"The request was rejected because the domain \" + serverName + \" is untrusted.\");\n\t\t}\n\t}\n\n\t@Override\n\tpublic HttpServletResponse getFirewalledResponse(HttpServletResponse response) {\n\t\treturn new FirewalledResponse(response);\n\t}\n\n\tprivate static Set<String> createDefaultAllowedHttpMethods() {\n\t\tSet<String> result = new HashSet<>();\n\t\tresult.add(HttpMethod.DELETE.name());\n\t\tresult.add(HttpMethod.GET.name());\n\t\tresult.add(HttpMethod.HEAD.name());\n\t\tresult.add(HttpMethod.OPTIONS.name());\n\t\tresult.add(HttpMethod.PATCH.name());\n\t\tresult.add(HttpMethod.POST.name());\n\t\tresult.add(HttpMethod.PUT.name());","sourceCodeStart":547,"sourceCodeEnd":583,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java#L547-L583","documentation":"StrictHttpFirewall's rejectedUntrustedHosts() checks the request's serverName (Host header) against the configured allowedHostnames predicate. This RequestRejectedException fires when the host is not in the allowlist, defending against host-header-injection attacks (e.g. cache poisoning, password-reset link manipulation) where an attacker supplies an arbitrary Host header and the server accepts it.","triggerScenarios":"Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:565 when the library encounters an invalid state.","commonSituations":"See trigger scenarios.","solutions":["Add the legitimate hostname(s) to the firewall via setAllowedHostnames(Predicate) so expected domains are accepted","Ensure the Host header matches your deployed domain; reject requests with spoofed or empty hosts at the proxy too","Verify virtual-host routing so the request reaches the server with the intended Host value"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":null,"preventionTips":[],"tags":[],"backgroundTag":null,"analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-23T08:17:48.524Z"}