spring-projects/spring-security · error · RequestRejectedException

The request was rejected because the header name \"" + heade

Error message

The request was rejected because the header name \"" + headerNames + "\" is not allowed.

What it means

StrictHttpFirewall's StrictFirewalledRequest validates every header name accessed through the wrapped request against the allowedHeaderNames predicate. This RequestRejectedException fires when a header name contains characters outside the allowed set — for example non-printable ASCII, CR/LF, or other control characters — which would indicate header-injection or smuggling attempts. The firewall rejects the request rather than exposing the malicious header to the application.

Source

Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:836

		}

		@Override
		public String[] getParameterValues(String name) {
			if (name != null) {
				validateAllowedParameterName(name);
			}
			String[] values = super.getParameterValues(name);
			if (values != null) {
				for (String value : values) {
					validateAllowedParameterValue(name, value);
				}
			}
			return values;
		}

		private void validateAllowedHeaderName(String headerNames) {
			if (!StrictHttpFirewall.this.allowedHeaderNames.test(headerNames)) {
				throw new RequestRejectedException(
						"The request was rejected because the header name \"" + headerNames + "\" is not allowed.");
			}
		}

		private void validateAllowedHeaderValue(String name, String value) {
			if (!StrictHttpFirewall.this.allowedHeaderValues.test(value)) {
				throw new RequestRejectedException("The request was rejected because the header: \"" + name
						+ " \" has a value \"" + value + "\" that is not allowed.");
			}
		}

		private void validateAllowedParameterName(String name) {
			if (!StrictHttpFirewall.this.allowedParameterNames.test(name)) {
				throw new RequestRejectedException(
						"The request was rejected because the parameter name \"" + name + "\" is not allowed.");
			}
		}

View on GitHub (pinned to 96852e8860)

Solutions

1. Locate and fix the client/proxy sending headers with illegal characters (control chars, CR/LF) in their names
2. If a legitimate custom header is blocked, widen allowedHeaderNames via setAllowedHeaderNames(Predicate) with a safe pattern
3. Reject such requests at the reverse proxy before they reach the application

When it happens

Trigger: Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:836 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/48342e7f6c003785. Report an issue: GitHub.