{"record":{"id":"04b3bfa48a35e9f9","repo":"quarkusio/quarkus","slug":"argument-exposedheader-cannot-be-null","errorCode":null,"errorMessage":"Argument 'exposedHeader' cannot be null","messagePattern":"Argument 'exposedHeader' cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java","lineNumber":103,"sourceCode":"        }\n\n        /**\n         * @param accessControlAllowCredentials {@link CORSConfig#accessControlAllowCredentials()}\n         * @return this builder\n         */\n        public Builder accessControlAllowCredentials(boolean accessControlAllowCredentials) {\n            this.accessControlAllowCredentials = Optional.of(accessControlAllowCredentials);\n            return this;\n        }\n\n        /**\n         * This method is a shortcut for {@code exposedHeaders(Set.of(exposedHeader))}.\n         *\n         * @return this builder\n         */\n        public Builder exposedHeader(String exposedHeader) {\n            if (exposedHeader == null) {\n                throw new IllegalArgumentException(\"Argument 'exposedHeader' cannot be null\");\n            }\n            return exposedHeaders(Set.of(exposedHeader));\n        }\n\n        /**\n         * @param exposedHeaders {@link CORSConfig#exposedHeaders()}\n         * @return this builder\n         */\n        public Builder exposedHeaders(Set<String> exposedHeaders) {\n            this.exposedHeaders = merge(this.exposedHeaders, exposedHeaders, \"Exposed headers\");\n            return this;\n        }\n\n        /**\n         * This method is a shortcut for {@code headers(Set.of(header))}.\n         *\n         * @return this builder\n         */","sourceCodeStart":85,"sourceCodeEnd":121,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java#L85-L121","documentation":"CORS.Builder.exposedHeader(String) rejects a null argument with an IllegalArgumentException before delegating to exposedHeaders(Set.of(exposedHeader)). The builder enforces non-null values because a null exposed header name is meaningless in the Access-Control-Expose-Headers configuration.","triggerScenarios":"Calling CORS.builder().exposedHeader(null) — typically when the header name comes from a nullable variable, config property, or map lookup that returned null.","commonSituations":"Reading header names from configuration or environment variables that are unset; passing the result of a null-returning lookup; chaining builders with optional values without defaulting.","solutions":["Pass a non-null header name string to exposedHeader()","Check the value for null before calling, or skip the call when absent","Fix the upstream source (config property, env var) so it yields a real value"],"exampleFix":"// before\nString name = config.getValue(\"exposed\");\nbuilder.exposedHeader(name);\n// after\nif (name != null) {\n    builder.exposedHeader(name);\n}","handlingStrategy":"validation","validationCode":"if (exposedHeader == null) { throw new IllegalStateException(\"exposedHeader name must be configured before calling builder.exposedHeader()\"); }","typeGuard":"boolean isValidHeader(String s) { return s != null && !s.isBlank(); }","tryCatchPattern":null,"preventionTips":["Null-check values sourced from config/env before builder calls","Use Optional and ifPresent for optional header names","Prefer Set-based setters with getOrDefault(..., Set.of())"],"tags":["quarkus","null-argument","cors","illegal-argument"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}