spring-projects/spring-security · error · RequestRejectedException

The request was rejected because the URL contained a potenti

Error message

The request was rejected because the URL contained a potentially malicious String \"" + forbidden + "\"

What it means

StrictHttpFirewall's rejectedBlocklistedUrls() scans the request URL (both the encoded and decoded forms) against configured blocklists of known-exploit strings such as path traversal ('../', './'), double dot variants, ';;', and URL-encoding tricks. This RequestRejectedException fires when the request URL contains one of these blocklisted sequences, indicating a likely path traversal or URL-manipulation attack, and the firewall rejects the request before it reaches the filter chain.

Source

Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:548

				.format("The %s was rejected because it can only contain printable ASCII characters.", propertyName));
		}
	}

	private void rejectForbiddenHttpMethod(HttpServletRequest request) {
		if (this.allowedHttpMethods == ALLOW_ANY_HTTP_METHOD) {
			return;
		}
		if (!this.allowedHttpMethods.contains(request.getMethod())) {
			throw new RequestRejectedException(
					"The request was rejected because the HTTP method \"" + request.getMethod()
							+ "\" was not included within the list of allowed HTTP methods " + this.allowedHttpMethods);
		}
	}

	private void rejectedBlocklistedUrls(HttpServletRequest request) {
		for (String forbidden : this.encodedUrlBlocklist) {
			if (encodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
		for (String forbidden : this.decodedUrlBlocklist) {
			if (decodedUrlContains(request, forbidden)) {
				throw new RequestRejectedException(
						"The request was rejected because the URL contained a potentially malicious String \""
								+ forbidden + "\"");
			}
		}
	}

	private void rejectedUntrustedHosts(HttpServletRequest request) {
		String serverName = request.getServerName();
		if (serverName != null && !this.allowedHostnames.test(serverName)) {
			throw new RequestRejectedException(
					"The request was rejected because the domain " + serverName + " is untrusted.");

View on GitHub (pinned to 96852e8860)

Solutions

1. Fix or reject the offending client request; the URL contains a blocklisted sequence like '../', ';;' or an encoded variant
2. If a legitimate URL is blocked, adjust the blocklists via setEncodedUrlBlocklist/setDecodedUrlBlocklist (remove only what is safe for your app)
3. Normalize/encode client-side URLs so no traversal or encoded-malware patterns are sent

When it happens

Trigger: Thrown at web/src/main/java/org/springframework/security/web/firewall/StrictHttpFirewall.java:548 when the library encounters an invalid state.

Common situations: See trigger scenarios.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

AI-assisted analysis of spring-projects/spring-security@96852e8860 (2026-09-10). Data as JSON: /api/errors/a1c7b84376bc21ba. Report an issue: GitHub.