{"record":{"id":"d23c43f8f4cf1f7a","repo":"quarkusio/quarkus","slug":"argument-origin-cannot-be-null","errorCode":null,"errorMessage":"Argument 'origin' cannot be null","messagePattern":"Argument 'origin' cannot be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java","lineNumber":166,"sourceCode":"        }\n\n        /**\n         * @param newMethods {@link CORSConfig#methods()}\n         * @return this builder\n         */\n        public Builder methods(Set<String> newMethods) {\n            this.methods = merge(this.methods, newMethods, \"Methods\");\n            return this;\n        }\n\n        /**\n         * This method is a shortcut for {@code origins(Set.of(origin))}.\n         *\n         * @return this builder\n         */\n        public Builder origin(String origin) {\n            if (origin == null) {\n                throw new IllegalArgumentException(\"Argument 'origin' cannot be null\");\n            }\n            return origins(Set.of(origin));\n        }\n\n        /**\n         * @param newOrigins {@link CORSConfig#origins()}\n         * @return this builder\n         */\n        public Builder origins(Set<String> newOrigins) {\n            this.origins = merge(this.origins, newOrigins, \"Origins\");\n            return this;\n        }\n\n        /**\n         * @param returnExactOrigins {@link CORSConfig#returnExactOrigins()}\n         * @return this builder\n         */\n        public Builder returnExactOrigins(boolean returnExactOrigins) {","sourceCodeStart":148,"sourceCodeEnd":184,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java#L148-L184","documentation":"CORS.Builder.origin(String) rejects a null argument with an IllegalArgumentException before delegating to origins(Set.of(origin)). A null is not a valid origin for the Access-Control-Allow-Origin configuration.","triggerScenarios":"Calling CORS.builder().origin(null), commonly when origins are read from config, a database, or a request-derived value.","commonSituations":"Empty/missing quarkus.http.cors origins config; null return from a hostname/origin resolution helper.","solutions":["Pass a non-null origin string (e.g. \"https://example.com\")","Null-check or use an Optional before calling","Set the origins via config instead of code"],"exampleFix":"// before\nbuilder.origin(System.getenv(\"ALLOWED_ORIGIN\"));\n// after\nString origin = System.getenv(\"ALLOWED_ORIGIN\");\nif (origin != null) {\n    builder.origin(origin);\n}","handlingStrategy":"validation","validationCode":"if (origin == null) { throw new IllegalStateException(\"Allowed origin must be configured before builder.origin()\"); }","typeGuard":"boolean isValidOrigin(String o) { return o != null && o.startsWith(\"http\"); }","tryCatchPattern":null,"preventionTips":["Store allowed origins in config with defaults","Use Optional.ofNullable(origin).ifPresent(builder::origin)","Validate origin format before adding"],"tags":["quarkus","null-argument","cors","illegal-argument"],"backgroundTag":"null-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}