Allowed request injection when a valid is present