Network Management

SolarWinds Web Console Shows RejectURL=true When Accessed Through Load Balancer FQDN after upgrade to 2025.4.x

When accessing the SolarWinds Web Console through a Load Balancer or VIP, users may encounter redirects that include RejectURL=true. This is due to SolarWinds Host Header Validation which is a feature designed to prevent Host Header spoofing attacks, which are a type of web-layer security vulnerability.

First published date

11/20/2025 12:30 AM

Last published date

1/31/2026 3:42 PM

Overview

SolarWinds Observability Self-Hosted includes built-in HTTP Host Header validation as a security mechanism to prevent Host Header attacks. When a request is made to SolarWinds using a hostname or IP that is not explicitly allowed, the platform blocks the request and internally triggers a redirect containing:

RejectURL=true

This behavior can appear when SolarWinds Observability Self-Hosted is accessed through:

  • A load balancer VIP

  • Reverse proxy

  • Alternate DNS names or aliases

  • Failover IPs in HA environments

If the VIP is not added to the allowed headers list, SolarWinds Observability Self-Hosted assumes the request is unsafe and rejects it.

Symptoms:

Affected users may experience one or more of the following:

  • The login URL automatically appends:
    ?rejecturl=true

  • The SolarWinds Web Console loads in a broken or unformatted state
    (CSS, images, and script files fail to load)

  • The login page appears disorganized or missing layout styling
    similar to plain HTML output

  • Login attempts fail repeatedly, even with valid credentials

  • Some UI elements (icons, buttons, images) appear as broken image links.

From the SolarWinds Observability Self-Hosted Web log, you may also find the following warnings:

WARN SolarWinds.Orion.Web.HttpModules.HttpHeaderValidationModule  
IP addresses: [non-whitelisted IP] associated with HTTP request Host header 'LoadBalancer_FQDN'  
not in whitelist: [::1, x.x.x.x, 127.0.0.1]

 

Product section

Network Performance Monitor

Cause

This issue occurs when SolarWinds Observability Self-Hosted is rejecting the web request because the Host header used resolves to an IP address not included in the Host Header allow list.

Resolution

To resolve this issue, please upgrade to SolarWinds Platform 2026.1 and above.  If upgrade is not possible, please apply the workaround below:

 

  • Access the Advanced Configuration Page:
    Open a browser and go to the following URL on either the main or additional web server:
    http://YOUR_SERVER/Orion/Admin/AdvancedConfiguration/Global.aspx
  • Locate the Setting:
    In Global Settings, find AllowedHttpRequestHostHeaders
  • If using a load balancer, add the Load Balancer’s IP address to the list and save the changes

NOTE: We need to add the VIP of the load balancer, not the server IP address.

  • If using alternate DNS names or aliases, add the alternate DNS name or alias to the list and save the changes
  • Disable High Availability (HA) temporarily, if enabled. See https://documentation.solarwinds.com/en/success_center/orionplatform/content/ha-manage-pools.htm
  • Restart Services:
    Restart all SolarWinds services on both the Main Web Server and Additional Web Server
  • Re-enable High Availability (HA) after the services are restarted
  • Access the Web Console:
    Open the Web Console using the FQDN URL to verify connectivity