{"record":{"id":"b3117b3793175096","repo":"quarkusio/quarkus","slug":"principal-was-null","errorCode":null,"errorMessage":"principal was null","messagePattern":"principal was null","errorType":"exception","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-undertow/src/main/java/io/quarkus/it/undertow/elytron/AnnotationSecurityServlet.java","lineNumber":35,"sourceCode":"        @HttpMethodConstraint(value = \"DELETE\", emptyRoleSemantic = ServletSecurity.EmptyRoleSemantic.DENY),\n        @HttpMethodConstraint(value = \"POST\", rolesAllowed = \"interns\")\n})\npublic class AnnotationSecurityServlet extends HttpServlet {\n\n    @Override\n    protected void doPut(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {\n\n    }\n\n    @Override\n    protected void doDelete(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {\n        doGet(req, resp);\n    }\n\n    @Override\n    protected void doGet(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {\n        if (req.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"principal was null\");\n        }\n        resp.setStatus(200);\n        resp.addHeader(\"Content-Type\", \"text/plain\");\n        resp.getWriter().write(\"hello\");\n    }\n\n    @Override\n    protected void doPost(HttpServletRequest req, HttpServletResponse resp) throws ServletException, IOException {\n        if (req.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"principal was null\");\n        }\n        String name = req.getReader().readLine();\n        resp.setStatus(200);\n        resp.addHeader(\"Content-Type\", \"text/plain\");\n        resp.getWriter().write(\"hello \" + name);\n    }\n}\n","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-undertow/src/main/java/io/quarkus/it/undertow/elytron/AnnotationSecurityServlet.java#L17-L53","documentation":"Sentinel RuntimeException thrown by AnnotationSecurityServlet.doGet() (also reached via doDelete) when HttpServletRequest.getUserPrincipal() returns null (so getName() would NPE) — the servlet is testing that Elytron annotation-based security populated the principal for secured paths.","triggerScenarios":"GET or DELETE request to the servlet's secured path without an authenticated principal — missing credentials or annotation-based auth not enforcing/propagating the identity into the Undertow request.","commonSituations":"Calling secured servlet endpoints without Basic Auth; @ServletSecurity annotations not applied (security build misconfigured); Undertow/Elytron integration not wiring the auth mechanism.","solutions":["Send the request with valid Basic Auth credentials matching the Elytron realm","Verify @ServletSecurity / @RolesAllowed annotations are honored by the elytron-undertow extension configuration","Check application.properties realm/user definitions for the undertow Elytron integration","Confirm the servlet mapping's security constraint is not bypassed by a permit-all rule"],"exampleFix":"// before\ncurl http://localhost:8080/annotation-servlet\n// after\ncurl -u admin:admin http://localhost:8080/annotation-servlet","handlingStrategy":"type-guard","validationCode":"Principal p = req.getUserPrincipal();\nif (p == null) {\n    resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"Authentication required\");\n    return;\n}","typeGuard":"boolean hasPrincipal(HttpServletRequest req) {\n    Principal p = req.getUserPrincipal();\n    return p != null && p.getName() != null;\n}","tryCatchPattern":"try {\n    handleRequest(req, resp);\n} catch (RuntimeException e) {\n    resp.sendError(HttpServletResponse.SC_UNAUTHORIZED, \"No principal attached\");\n}","preventionTips":["Null-check getUserPrincipal() before calling getName()","Always authenticate servlet test requests with realm credentials","Verify @ServletSecurity annotations are enforced after Undertow config changes"],"tags":["security","elytron","undertow","servlet","user-principal"],"backgroundTag":"user-principal-null","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}