{"record":{"id":"2bb854673c5ef21b","repo":"quarkusio/quarkus","slug":"client-authentication-cannot-be-disabled-with-this","errorCode":null,"errorMessage":"Client authentication cannot be disabled with this API","messagePattern":"Client authentication cannot be disabled with this API","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":199,"sourceCode":"    @Override\n    public HttpSecurity mTLS(String tlsConfigurationName, TlsConfiguration tlsConfiguration) {\n        return mechanism(MTLS.required(tlsConfigurationName, tlsConfiguration));\n    }\n\n    @Override\n    public HttpSecurity mTLS(MtlsAuthenticationMechanism mTLSAuthenticationMechanism) {\n        return mechanism(mTLSAuthenticationMechanism);\n    }\n\n    @Override\n    public HttpSecurity mTLS(ClientAuth tlsClientAuth) {\n        if (tlsClientAuth == null) {\n            throw new IllegalArgumentException(\"Client authentication cannot be null\");\n        }\n        return switch (tlsClientAuth) {\n            case REQUIRED -> mechanism(MTLS.required());\n            case REQUEST -> mechanism(MTLS.request());\n            case NONE -> throw new IllegalArgumentException(\"Client authentication cannot be disabled with this API\");\n        };\n    }\n\n    @Override\n    public HttpPermission path(String... patterns) {\n        if (patterns == null || patterns.length == 0) {\n            throw new IllegalArgumentException(\"Paths must not be empty\");\n        }\n        var httpPermission = new HttpPermissionImpl(patterns);\n        httpPermissions.add(httpPermission);\n        return httpPermission;\n    }\n\n    @Override\n    public HttpPermission get(String... paths) {\n        return path(paths).methods(\"GET\");\n    }\n","sourceCodeStart":181,"sourceCodeEnd":217,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L181-L217","documentation":"The programmatic HttpSecurity.mTLS() API only supports enabling TLS client authentication (REQUIRED or REQUEST). Passing ClientAuth.NONE would attempt to disable mTLS through an API designed only to enable it, which Quarkus explicitly forbids with an IllegalArgumentException. Disabling belongs to configuration (quarkus.http.ssl.client-auth=NONE, the default).","triggerScenarios":"Calling httpSecurity.mTLS(ClientAuth.NONE), often when the ClientAuth value comes from a config enum or switch that includes NONE as a possible case.","commonSituations":"Applications mapping quarkus.http.ssl.client-auth values directly into the programmatic API without filtering out NONE; generic security-setup code iterating all ClientAuth values.","solutions":["Only call mTLS() for REQUIRED or REQUEST; skip the call when the desired value is NONE.","Handle NONE by relying on the default configuration (no client auth) instead of the API.","Filter dynamic input: if (auth != ClientAuth.NONE) httpSecurity.mTLS(auth);"],"exampleFix":"// before\nhttpSecurity.mTLS(ClientAuth.NONE); // throws\n// after\nif (desiredAuth != ClientAuth.NONE) {\n    httpSecurity.mTLS(desiredAuth);\n} // NONE: do nothing, it is the default","handlingStrategy":"validation","validationCode":"if (clientAuth != null && clientAuth != ClientAuth.NONE) {\n    httpSecurity.mTLS(clientAuth);\n} // NONE: skip; disabled is the default state","typeGuard":"boolean canEnableMtls(ClientAuth auth) {\n    return auth == ClientAuth.REQUIRED || auth == ClientAuth.REQUEST;\n}","tryCatchPattern":"try {\n    httpSecurity.mTLS(clientAuth);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"cannot be disabled\")) {\n        log.warn(\"ClientAuth.NONE is not supported by mTLS(); ignoring (already disabled by default)\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Filter out ClientAuth.NONE before calling the programmatic mTLS API.","Remember NONE is the default; disabling requires no action.","When mapping config enums into this API, handle NONE in a separate branch."],"tags":["quarkus","http-security","mtls","tls","invalid-argument"],"backgroundTag":"unsupported-api-usage","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}