{"record":{"id":"22ebb67121c43192","repo":"spring-projects/spring-security","slug":"cannot-pass-null-or-empty-values-to-constructor","errorCode":null,"errorMessage":"Cannot pass null or empty values to constructor","messagePattern":"Cannot pass null or empty values to constructor","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationToken.java","lineNumber":98,"sourceCode":"\t * <code>null</code>)\n\t * @param authorities the authorities granted to the user (from the\n\t * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot\n\t * be <code>null</code>)\n\t * @param userDetails the user details (from the\n\t * {@link org.springframework.security.core.userdetails.UserDetailsService}) (cannot\n\t * be <code>null</code>)\n\t * @param assertion the assertion returned from the CAS servers. It contains the\n\t * principal and how to obtain a proxy ticket for the user.\n\t * @throws IllegalArgumentException if a <code>null</code> was passed\n\t * @since 4.2\n\t */\n\tprivate CasAuthenticationToken(final Integer keyHash, final Object principal, final Object credentials,\n\t\t\tfinal Collection<? extends GrantedAuthority> authorities, final UserDetails userDetails,\n\t\t\tfinal Assertion assertion) {\n\t\tsuper(authorities);\n\t\tif ((principal == null) || \"\".equals(principal) || (credentials == null) || \"\".equals(credentials)\n\t\t\t\t|| (authorities == null) || (userDetails == null) || (assertion == null)) {\n\t\t\tthrow new IllegalArgumentException(\"Cannot pass null or empty values to constructor\");\n\t\t}\n\t\tthis.keyHash = keyHash;\n\t\tthis.principal = principal;\n\t\tthis.credentials = credentials;\n\t\tthis.userDetails = userDetails;\n\t\tthis.assertion = assertion;\n\t\tsetAuthenticated(true);\n\t}\n\n\tprotected CasAuthenticationToken(Builder<?> builder) {\n\t\tsuper(builder);\n\t\tAssert.isTrue(!\"\".equals(builder.principal), \"principal cannot be null or empty\");\n\t\tAssert.isTrue(!\"\".equals(builder.credentials), \"credentials cannot be null or empty\");\n\t\tAssert.notNull(builder.userDetails, \"userDetails cannot be null\");\n\t\tAssert.notNull(builder.assertion, \"assertion cannot be null\");\n\t\tthis.keyHash = builder.keyHash;\n\t\tthis.principal = builder.principal;\n\t\tthis.credentials = builder.credentials;","sourceCodeStart":80,"sourceCodeEnd":116,"githubUrl":"https://github.com/spring-projects/spring-security/blob/96852e8860138a482cb13d1479573f24ff6443c6/cas/src/main/java/org/springframework/security/cas/authentication/CasAuthenticationToken.java#L80-L116","documentation":"The private CasAuthenticationToken constructor validates its inputs and throws IllegalArgumentException if principal, credentials, authorities, userDetails, or assertion is null or equals the empty string. This is an internal invariant guard ensuring a fully-populated CAS authentication token; the public constructor also checks that the key hash matches before delegating here.","triggerScenarios":"Calling new CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion) with any null/empty argument, or building the token programmatically (e.g. in tests or a custom provider) with an empty credentials string or null assertion.","commonSituations":"Custom authentication providers or tests constructing CasAuthenticationToken directly without a valid Assertion; migrating code that previously passed null credentials; reflection-based test helpers missing fields.","solutions":["Ensure every argument is non-null and non-empty before constructing the token, especially credentials and assertion.","When faking tokens in tests, use a real or mocked Assertion instance and non-empty credentials.","Check the key hash too: the public constructor throws BadCredentialsException if key.hashCode() != keyHash, a separate common failure.","If principal may legitimately be empty, wrap or substitute an anonymous UserDetails instead of \"\"."],"exampleFix":"// before\nnew CasAuthenticationToken(key, principal, \"\", authorities, userDetails, null);\n// after\nAssert.notNull(assertion, \"assertion required\");\nnew CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion); // all args non-null/non-empty","handlingStrategy":"validation","validationCode":"if (principal == null || \"\".equals(principal) || credentials == null || \"\".equals(credentials)\n        || authorities == null || userDetails == null || assertion == null) {\n    throw new IllegalArgumentException(\"all CasAuthenticationToken arguments must be non-null and non-empty\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    new CasAuthenticationToken(key, principal, credentials, authorities, userDetails, assertion);\n} catch (IllegalArgumentException e) {\n    log.error(\"Invalid CAS token args: check credentials/assertion are populated\", e);\n}","preventionTips":["Always build tokens with a real Assertion instance","Validate inputs before constructing authentication tokens","Remember the public constructor also checks key hash: use key.hashCode()","In tests, use factory helpers to create fully populated tokens"],"tags":["cas","illegal-argument","constructor","authentication"],"backgroundTag":"invalid-constructor-argument","analyzedSha":"96852e8860138a482cb13d1479573f24ff6443c6","analyzedAt":"2026-09-10T23:25:23.477Z","contentChangedAt":"2026-09-10T23:25:23.477Z","schemaVersion":2},"datasetVersion":"2026-09-14T11:17:12.474Z"}