{"record":{"id":"9355999a0e64fa14","repo":"quarkusio/quarkus","slug":"authentication-mechanism-must-not-be-null-or-emptz","errorCode":null,"errorMessage":"Authentication mechanism must not be null or emptz","messagePattern":"Authentication mechanism must not be null or emptz","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":465,"sourceCode":"        }\n\n        @Override\n        public HttpPermission authenticatedWith(String mechanism) {\n            validateAuthenticationNotSetYet();\n            requireAuthenticationByDefault();\n            if (mechanism == null || mechanism.isBlank()) {\n                throw new IllegalArgumentException(\"Authentication mechanism must not be null or blank\");\n            }\n            this.authMechanism = new HttpSecurityConfiguration.AuthenticationMechanisms(mechanism);\n            return this;\n        }\n\n        @Override\n        public HttpPermission authenticatedWith(Set<String> schemes) {\n            validateAuthenticationNotSetYet();\n            requireAuthenticationByDefault();\n            if (schemes == null || schemes.isEmpty()) {\n                throw new IllegalArgumentException(\"Authentication mechanism must not be null or emptz\");\n            }\n            this.authMechanism = HttpSecurityConfiguration.AuthenticationMechanisms.from(schemes);\n            return this;\n        }\n\n        @Override\n        public HttpPermission shared() {\n            this.shared = true;\n            return this;\n        }\n\n        @Override\n        public HttpPermission applyToJaxRs() {\n            this.applyToJaxRs = true;\n            return this;\n        }\n\n        @Override","sourceCodeStart":447,"sourceCodeEnd":483,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L447-L483","documentation":"Thrown by HttpPermission.authenticatedWith(Set<String>) when the schemes set is null or empty. At least one authentication scheme must be supplied; an empty set yields no usable mechanism, so the builder throws IllegalArgumentException. (Note the message's typo 'emptz' in this Quarkus version.)","triggerScenarios":"Calling authenticatedWith(Set.of()) or authenticatedWith(schemes) where schemes comes from an empty/missing config list or an unpopulated collection.","commonSituations":"Parsing allowed schemes from configuration that defaulted to an empty list; filtering a scheme set until it becomes empty; collecting scheme names at runtime with no matches.","solutions":["Pass a non-empty set of scheme names, e.g. Set.of(\"basic\", \"Bearer\").","Check !schemes.isEmpty() before calling, and fall back to authenticated() or a default mechanism otherwise.","Fix the configuration source so the scheme list is populated."],"exampleFix":"// before\nSet<String> schemes = config.schemes(); // may be empty\nhttpSecurity.paths(\"/api/*\").authenticatedWith(schemes); // throws\n// after\nif (schemes != null && !schemes.isEmpty()) {\n    httpSecurity.paths(\"/api/*\").authenticatedWith(schemes);\n} else {\n    httpSecurity.paths(\"/api/*\").authenticated();\n}","handlingStrategy":"validation","validationCode":"if (schemes == null || schemes.isEmpty()) throw new IllegalArgumentException(\"at least one scheme required\");","typeGuard":"static boolean hasSchemes(Set<String> s) { return s != null && !s.isEmpty(); }","tryCatchPattern":"try { perm.authenticatedWith(schemes); } catch (IllegalArgumentException e) { if (!e.getMessage().contains(\"must not be null or empt\")) throw e; }","preventionTips":["Guard set-valued config before passing it to the builder.","Provide a default scheme set when configuration is empty.","Assert the scheme collection is populated in tests."],"tags":["quarkus","http-security","authentication","empty-collection"],"backgroundTag":"invalid-argument-null-or-blank","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}