{"record":{"id":"797682f2ecb6e97c","repo":"quarkusio/quarkus","slug":"http-methods-must-not-be-null-or-empty","errorCode":null,"errorMessage":"HTTP methods must not be null or empty","messagePattern":"HTTP methods must not be null or empty","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":486,"sourceCode":"            return this;\n        }\n\n        @Override\n        public HttpPermission shared() {\n            this.shared = true;\n            return this;\n        }\n\n        @Override\n        public HttpPermission applyToJaxRs() {\n            this.applyToJaxRs = true;\n            return this;\n        }\n\n        @Override\n        public HttpPermission methods(String... httpMethods) {\n            if (httpMethods == null || httpMethods.length == 0) {\n                throw new IllegalArgumentException(\"HTTP methods must not be null or empty\");\n            }\n            this.methods = Arrays.copyOf(httpMethods, httpMethods.length);\n            return this;\n        }\n\n        @Override\n        public AuthorizationPolicy authorization() {\n            validateAuthorizationNotSetYet();\n            this.authorizationPolicy = new AuthorizationPolicy();\n            return authorizationPolicy;\n        }\n\n        @Override\n        public HttpSecurity permit() {\n            return authorization().permit();\n        }\n\n        @Override","sourceCodeStart":468,"sourceCodeEnd":504,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L468-L504","documentation":"Thrown by HttpPermission.methods(String...) when the varargs array is null or has zero elements. Restricting a permission to specific HTTP methods requires at least one method name; otherwise the restriction would be meaningless, so IllegalArgumentException is thrown.","triggerScenarios":"Calling .methods() with no arguments, .methods(null), or spreading an empty/null String[] built from config or request data.","commonSituations":"Passing a dynamically built list of allowed methods that ended up empty; a config property like quarkus.http.auth...methods unset and mapped to an empty array; generic wrapper code forwarding varargs blindly.","solutions":["Pass at least one method, e.g. .methods(\"GET\", \"POST\").","Guard with (httpMethods != null && httpMethods.length > 0) and skip methods() (allowing all methods) when empty.","Fix the config/default so the method list is populated."],"exampleFix":"// before\nString[] ms = config.allowedMethods(); // may be empty\nhttpSecurity.paths(\"/api/*\").permitAll().methods(ms); // throws when empty\n// after\nif (ms != null && ms.length > 0) {\n    httpSecurity.paths(\"/api/*\").permitAll().methods(ms);\n}","handlingStrategy":"validation","validationCode":"if (httpMethods == null || httpMethods.length == 0) throw new IllegalArgumentException(\"at least one HTTP method required\");","typeGuard":"static boolean hasMethods(String... ms) { return ms != null && ms.length > 0; }","tryCatchPattern":"try { perm.methods(methods); } catch (IllegalArgumentException e) { if (!e.getMessage().contains(\"HTTP methods must not be null or empty\")) throw e; }","preventionTips":["Check varargs arrays before forwarding them.","Provide defaults (e.g. GET) for empty method config.","Use uppercase standard method names."],"tags":["quarkus","http-security","validation","varargs"],"backgroundTag":"invalid-argument-null-or-blank","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}