{"record":{"id":"d0e225265f002ecb","repo":"quarkusio/quarkus","slug":"no-post-data","errorCode":null,"errorMessage":"No post data","messagePattern":"No post data","errorType":"http","errorClass":"RuntimeException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java","lineNumber":35,"sourceCode":"\nimport io.quarkus.security.Authenticated;\nimport io.quarkus.security.PermissionChecker;\nimport io.quarkus.security.PermissionsAllowed;\nimport io.quarkus.security.identity.SecurityIdentity;\nimport io.quarkus.vertx.http.runtime.security.HttpSecurityUtils;\n\n@Path(\"/\")\npublic class RootResource {\n    @Inject\n    SecurityIdentity identity;\n    @Inject\n    Principal principal;\n\n    @POST\n    @Consumes(MediaType.TEXT_PLAIN)\n    public String posts(String data, @Context SecurityContext sec) {\n        if (data == null) {\n            throw new RuntimeException(\"No post data\");\n        }\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"post success\";\n    }\n\n    @GET\n    @Produces(MediaType.TEXT_PLAIN)\n    public String approval(@Context SecurityContext sec) {\n        if (sec.getUserPrincipal().getName() == null) {\n            throw new RuntimeException(\"Failed to get user principal\");\n        }\n        return \"get success\";\n    }\n\n    @GET\n    @Path(\"/secure\")","sourceCodeStart":17,"sourceCodeEnd":53,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-resteasy/src/main/java/io/quarkus/it/resteasy/elytron/RootResource.java#L17-L53","documentation":"Thrown by RootResource.posts when the POSTed request body is null. In practice with RESTEasy a missing TEXT_PLAIN body is usually rejected earlier, so this guard triggers when some proxy/injection path delivers a null entity. It is a defensive null-check before authenticating the request via the security context.","triggerScenarios":"POST with no body (empty entity) to the TEXT_PLAIN-consuming endpoint, or a client sending Content-Length: 0.","commonSituations":"curl -X POST without -d; test clients forgetting to set the body; HTTP client libraries sending an empty payload with Content-Type text/plain.","solutions":["Send a non-empty text/plain body (e.g. curl -X POST -H 'Content-Type: text/plain' -d 'data' ...).","Include valid credentials so authentication succeeds before the principal check.","If the guard should not be reachable, expect an earlier 4xx from RESTEasy and adjust tests accordingly."],"exampleFix":"// before\ncurl -X POST http://localhost:8080/rest-elytron\n// after\ncurl -X POST -H 'Content-Type: text/plain' -u user:password -d 'hello' http://localhost:8080/rest-elytron","handlingStrategy":"validation","validationCode":"if (payload == null || payload.isEmpty()) {\n    throw new IllegalArgumentException(\"POST body must be non-empty text/plain\");\n}","typeGuard":"boolean hasBody(String s) { return s != null && !s.isEmpty(); }","tryCatchPattern":"try {\n    String resp = target.request().post(Entity.text(payload));\n} catch (javax.ws.rs.InternalServerErrorException e) {\n    log.error(\"POST rejected: missing body or principal issue\", e);\n}","preventionTips":["Always send a non-empty body with Content-Type: text/plain.","Authenticate with valid credentials before posting.","Check Content-Length is non-zero in HTTP clients."],"tags":["resteasy","elytron","missing-body"],"backgroundTag":"empty-request-body","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}