{"record":{"id":"b203b6edd2a77980","repo":"quarkusio/quarkus","slug":"the-authorizationpolicy-annotation-placed-on-ta","errorCode":null,"errorMessage":"The @AuthorizationPolicy annotation placed on '<target>' must not have blank policy name.","messagePattern":"The @AuthorizationPolicy annotation placed on '<target>' must not have blank policy name\\.","errorType":"validation","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java","lineNumber":581,"sourceCode":"                    new AdditionalSecurityConstrainerEventPropsBuildItem(recorder.createAdditionalSecEventPropsSupplier()));\n        }\n    }\n\n    private static Map<MethodInfo, String> gatherAuthorizationPolicyInstances(CombinedIndexBuildItem combinedIndex,\n            Optional<SecurityTransformerBuildItem> securityTransformerBuildItem) {\n        SecurityTransformer securityTransformer = SecurityTransformerBuildItem.createSecurityTransformer(\n                combinedIndex.getIndex(), securityTransformerBuildItem);\n        var methodToPolicy = securityTransformer\n                // @AuthorizationPolicy(name = \"policy-name\")\n                .getAnnotations(AUTHORIZATION_POLICY)\n                .stream()\n                .flatMap(ai -> {\n                    var policyName = ai.value(\"name\").asString();\n                    if (policyName.isBlank()) {\n                        var targetName = ai.target().kind() == AnnotationTarget.Kind.CLASS\n                                ? ai.target().asClass().name().toString()\n                                : ai.target().asMethod().name();\n                        throw new RuntimeException(\"\"\"\n                                The @AuthorizationPolicy annotation placed on '%s' must not have blank policy name.\n                                \"\"\".formatted(targetName));\n                    }\n                    return getPolicyTargetEndpointCandidates(ai.target(), securityTransformer)\n                            .map(mi -> Map.entry(mi, policyName));\n                })\n                .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue));\n        return Collections.unmodifiableMap(methodToPolicy);\n    }\n\n    @BuildStep\n    AdditionalSecurityAnnotationBuildItem registerAuthorizationPolicyAnnotation() {\n        return new AdditionalSecurityAnnotationBuildItem(AUTHORIZATION_POLICY);\n    }\n\n    /**\n     * Implements {@link io.quarkus.vertx.http.runtime.security.AuthorizationPolicyStorage} as a bean.\n     * If no {@link AuthorizationPolicy} are detected, generated bean will look like this:","sourceCodeStart":563,"sourceCodeEnd":599,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java#L563-L599","documentation":"During HTTP security processing, Quarkus scans all @AuthorizationPolicy annotations and reads their 'name' attribute, which identifies the registered policy to apply. The annotation is useless without a name because no policy can be looked up, so the build fails fast with a RuntimeException naming the annotated class or method. This guards against typos or placeholder values like \"\" left in the annotation.","triggerScenarios":"Annotating a REST endpoint class or method with @AuthorizationPolicy(name = \"\") or @AuthorizationPolicy (leaving name blank/default) while the vertx-http security processing runs at build time.","commonSituations":"Copying an @AuthorizationPolicy example and forgetting to fill in the policy name; defining the policy later and leaving a placeholder empty string; refactoring that removed the name value.","solutions":["Set a non-blank policy name in the annotation, e.g. @AuthorizationPolicy(name = \"admin\")","Ensure a policy with that name is registered (e.g. via a PolicyMappingBuildItem or named HttpSecurityPolicy)","Rebuild the application after fixing the annotation"],"exampleFix":"// before\n@AuthorizationPolicy(name = \"\")\npublic class AdminResource { ... }\n// after\n@AuthorizationPolicy(name = \"admin-policy\")\npublic class AdminResource { ... }","handlingStrategy":"validation","validationCode":"AuthorizationPolicy policy = resource.getClass().getAnnotation(AuthorizationPolicy.class);\nif (policy != null && (policy.name() == null || policy.name().isBlank())) {\n    throw new IllegalStateException(\"@AuthorizationPolicy on \" + resource.getClass().getName() + \" needs a non-blank name\");\n}","typeGuard":"boolean hasNamedPolicy(Class<?> c) {\n    AuthorizationPolicy a = c.getAnnotation(AuthorizationPolicy.class);\n    return a != null && !a.name().isBlank();\n}","tryCatchPattern":null,"preventionTips":["Always supply an explicit, descriptive name in @AuthorizationPolicy","Register a matching policy for every name you reference","Review security annotations in code review for blank/placeholder values"],"tags":["quarkus","build-time","security","annotation"],"backgroundTag":"blank-policy-name","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}