spring-projects/spring-security · error · RequestRejectedException

The request was rejected because the domain " + serverName…

Error message

The request was rejected because the domain " + serverName + " is untrusted.

What it means

StrictHttpFirewall's rejectedUntrustedHosts() checks the request's serverName (Host header) against the configured allowedHostnames predicate. This RequestRejectedException fires when the host is not in the allowlist, defending against host-header-injection attacks (e.g. cache poisoning, password-reset link manipulation) where an attacker supplies an arbitrary Host header and the server accepts it.

Solutions

1. Add the legitimate hostname(s) to the firewall via setAllowedHostnames(Predicate) so expected domains are accepted
2. Ensure the Host header matches your deployed domain; reject requests with spoofed or empty hosts at the proxy too
3. Verify virtual-host routing so the request reaches the server with the intended Host value

When it happens

Trigger: Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:565 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/a48993cdfa6af5e2. Report an issue: GitHub.

Appendix: source

Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:565

			if (encodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
		for (String forbidden : this.decodedUrlBlocklist) {
			if (decodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
	}

	private void rejectedUntrustedHosts(HttpServletRequest request) {
		String serverName = request.getServerName();
		if (serverName != null && !this.allowedHostnames.test(serverName)) {
			throw new RequestRejectedException(
					"The request was rejected because the domain " + serverName + " is untrusted.");
		}
	}

	@Override
	public HttpServletResponse getFirewalledResponse(HttpServletResponse response) {
		return new FirewalledResponse(response);
	}

	private static Set<String> createDefaultAllowedHttpMethods() {
		Set<String> result = new HashSet<>();
		result.add(HttpMethod.DELETE.name());
		result.add(HttpMethod.GET.name());
		result.add(HttpMethod.HEAD.name());
		result.add(HttpMethod.OPTIONS.name());
		result.add(HttpMethod.PATCH.name());
		result.add(HttpMethod.POST.name());
		result.add(HttpMethod.PUT.name());

View on GitHub (pinned to 96852e8860)