{"record":{"id":"783a11d220374c3c","repo":"quarkusio/quarkus","slug":"httpsecuritypolicy-must-not-be-null","errorCode":null,"errorMessage":"HttpSecurityPolicy must not be null","messagePattern":"HttpSecurityPolicy must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":340,"sourceCode":"            policy = new Policy(null, new PermissionsHttpSecurityPolicy(permissions));\n            return HttpSecurityImpl.this;\n        }\n\n        @Override\n        public HttpSecurity permissions(String... permissionNames) {\n            Objects.requireNonNull(permissionNames);\n            StringPermission[] stringPermissions = new StringPermission[permissionNames.length];\n            for (int i = 0; i < permissionNames.length; i++) {\n                stringPermissions[i] = new StringPermission(permissionNames[i]);\n            }\n            return permissions(stringPermissions);\n        }\n\n        @Override\n        public HttpSecurity policy(HttpSecurityPolicy httpSecurityPolicy) {\n            validatePolicyNotSetYet();\n            if (httpSecurityPolicy == null) {\n                throw new IllegalArgumentException(\"HttpSecurityPolicy must not be null\");\n            }\n            this.policy = new Policy(null, httpSecurityPolicy);\n            return HttpSecurityImpl.this;\n        }\n\n        @Override\n        public HttpSecurity policy(Predicate<SecurityIdentity> predicate) {\n            return policy((identity, request) -> !identity.isAnonymous() && predicate.test(identity));\n        }\n\n        @Override\n        public HttpSecurity policy(BiPredicate<SecurityIdentity, RoutingContext> predicate) {\n            return policy(new SimpleHttpSecurityPolicy(predicate));\n        }\n\n        private HttpSecurity authenticated() {\n            validatePolicyNotSetYet();\n            this.policy = new Policy(AuthenticatedHttpSecurityPolicy.NAME, null);","sourceCodeStart":322,"sourceCodeEnd":358,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L322-L358","documentation":"The PathPolicy's policy(HttpSecurityPolicy) method rejects a null policy argument with IllegalArgumentException. This is the generic escape hatch of the HttpSecurity DSL allowing any custom HttpSecurityPolicy implementation to be attached to a path; because the surrounding Policy holder cannot represent 'no policy', a null argument would corrupt the builder state, so it is validated immediately after validatePolicyNotSetYet().","triggerScenarios":"httpSecurity.path(\"/x\").policy(myPolicy) where myPolicy is an uninitialized field or a factory method returned null; a custom HttpSecurityPolicy bean that failed to resolve; supplying the result of an optional lookup without null handling.","commonSituations":"Plugging custom authorization logic into programmatic security where the policy instance is produced by CDI lookup or configuration that can be absent; test code with a not-yet-assigned policy field; refactors that replaced a concrete policy with a nullable supplier.","solutions":["Ensure a concrete HttpSecurityPolicy instance is constructed or injected before calling policy(...).","Skip the policy(...) call when no custom policy is available and rely on the default security behavior.","If the policy comes from CDI, verify the bean exists (correct qualifiers/scope) so the lookup does not return null."],"exampleFix":"// before\nHttpSecurityPolicy custom = lookupPolicy(); // may be null\nhttpSecurity.path(\"/api/*\").policy(custom);\n// after\nHttpSecurityPolicy custom = lookupPolicy();\nif (custom != null) {\n    httpSecurity.path(\"/api/*\").policy(custom);\n}","handlingStrategy":"validation","validationCode":"if (customPolicy != null) {\n    httpSecurity.path(path).policy(customPolicy);\n}","typeGuard":"static boolean hasPolicy(HttpSecurityPolicy p) {\n    return p != null;\n}","tryCatchPattern":"try {\n    httpSecurity.path(\"/api/*\").policy(customPolicy);\n} catch (IllegalArgumentException e) {\n    throw new IllegalStateException(\"Custom policy failed to resolve: \" + e.getMessage(), e);\n}","preventionTips":["Construct or inject the HttpSecurityPolicy before wiring it; check CDI lookups for null/empty results.","Skip policy(...) when no custom policy applies and rely on defaults.","Ensure custom policy factories always return an instance or throw, never return null."],"tags":["quarkus","http-security","custom-policy","null-check","argument-validation"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}