{"record":{"id":"21fb94d02131fb26","repo":"quarkusio/quarkus","slug":"authentication-mechanism-must-not-be-null-or-blank","errorCode":null,"errorMessage":"Authentication mechanism must not be null or blank","messagePattern":"Authentication mechanism must not be null or blank","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":454,"sourceCode":"            return authenticatedWith(\"webauthn\");\n        }\n\n        @Override\n        public HttpPermission authorizationCodeFlow() {\n            return authenticatedWith(\"code\");\n        }\n\n        @Override\n        public HttpSecurity authenticated() {\n            return authorization().authenticated();\n        }\n\n        @Override\n        public HttpPermission authenticatedWith(String mechanism) {\n            validateAuthenticationNotSetYet();\n            requireAuthenticationByDefault();\n            if (mechanism == null || mechanism.isBlank()) {\n                throw new IllegalArgumentException(\"Authentication mechanism must not be null or blank\");\n            }\n            this.authMechanism = new HttpSecurityConfiguration.AuthenticationMechanisms(mechanism);\n            return this;\n        }\n\n        @Override\n        public HttpPermission authenticatedWith(Set<String> schemes) {\n            validateAuthenticationNotSetYet();\n            requireAuthenticationByDefault();\n            if (schemes == null || schemes.isEmpty()) {\n                throw new IllegalArgumentException(\"Authentication mechanism must not be null or emptz\");\n            }\n            this.authMechanism = HttpSecurityConfiguration.AuthenticationMechanisms.from(schemes);\n            return this;\n        }\n\n        @Override\n        public HttpPermission shared() {","sourceCodeStart":436,"sourceCodeEnd":472,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L436-L472","documentation":"Thrown by HttpPermission.authenticatedWith(String) when the given mechanism name is null or blank. The string is used as the authentication mechanism identifier, so an empty value would produce an unusable policy; the builder rejects it immediately with IllegalArgumentException.","triggerScenarios":"Passing a null or \"\" mechanism name to authenticatedWith, or via wrappers basic()/form()/bearer()/webAuthn()/authorizationCodeFlow() built from a null/blank constant or config value.","commonSituations":"Reading the mechanism name from a config property or environment variable that is unset; typos yielding an empty string after trimming; dynamically built names from string concatenation.","solutions":["Pass a valid, non-blank mechanism name (e.g. BasicAuthentication.AUTH_MECHANISM_SCHEME or a registered named mechanism).","Validate/trim the value before the call; fail early if a config-derived value is missing.","Use a dedicated convenience method (basic(), form(), bearer(), ...) instead of hand-built strings."],"exampleFix":"// before\nString mech = config.getValue(\"auth.mechanism\"); // may be null\nhttpSecurity.paths(\"/api/*\").authenticatedWith(mech); // throws\n// after\nif (mech != null && !mech.isBlank()) {\n    httpSecurity.paths(\"/api/*\").authenticatedWith(mech);\n}","handlingStrategy":"validation","validationCode":"if (mechanism == null || mechanism.isBlank()) throw new IllegalArgumentException(\"mechanism required\");","typeGuard":"static boolean isValidMechanism(String m) { return m != null && !m.isBlank(); }","tryCatchPattern":"try { perm.authenticatedWith(mechanism); } catch (IllegalArgumentException e) { if (!e.getMessage().contains(\"must not be null or blank\")) throw e; }","preventionTips":["Validate config-derived mechanism names at startup.","Prefer constants like BasicAuthentication.AUTH_MECHANISM_SCHEME over raw strings.","Trim user/env-provided values before passing."],"tags":["quarkus","http-security","authentication","null-check"],"backgroundTag":"invalid-argument-null-or-blank","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}