{"record":{"id":"d3ab23846e5fbef2","repo":"quarkusio/quarkus","slug":"client-authentication-cannot-be-null","errorCode":null,"errorMessage":"Client authentication cannot be null","messagePattern":"Client authentication cannot be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":194,"sourceCode":"    @Override\n    public HttpSecurity mTLS() {\n        return mTLS(ClientAuth.REQUIRED);\n    }\n\n    @Override\n    public HttpSecurity mTLS(String tlsConfigurationName, TlsConfiguration tlsConfiguration) {\n        return mechanism(MTLS.required(tlsConfigurationName, tlsConfiguration));\n    }\n\n    @Override\n    public HttpSecurity mTLS(MtlsAuthenticationMechanism mTLSAuthenticationMechanism) {\n        return mechanism(mTLSAuthenticationMechanism);\n    }\n\n    @Override\n    public HttpSecurity mTLS(ClientAuth tlsClientAuth) {\n        if (tlsClientAuth == null) {\n            throw new IllegalArgumentException(\"Client authentication cannot be null\");\n        }\n        return switch (tlsClientAuth) {\n            case REQUIRED -> mechanism(MTLS.required());\n            case REQUEST -> mechanism(MTLS.request());\n            case NONE -> throw new IllegalArgumentException(\"Client authentication cannot be disabled with this API\");\n        };\n    }\n\n    @Override\n    public HttpPermission path(String... patterns) {\n        if (patterns == null || patterns.length == 0) {\n            throw new IllegalArgumentException(\"Paths must not be empty\");\n        }\n        var httpPermission = new HttpPermissionImpl(patterns);\n        httpPermissions.add(httpPermission);\n        return httpPermission;\n    }\n","sourceCodeStart":176,"sourceCodeEnd":212,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L176-L212","documentation":"HttpSecurity.mTLS(ClientAuth) requires an explicit ClientAuth value to decide between REQUIRED and REQUEST behavior. A null argument cannot be mapped to any TLS client-auth mode, so Quarkus rejects it immediately with an IllegalArgumentException to fail fast rather than producing an insecure default.","triggerScenarios":"Calling httpSecurity.mTLS(null), or passing a ClientAuth value read from config/custom code that resolves to null (e.g. Optional.get misuse upstream or an unset enum field).","commonSituations":"Deriving the ClientAuth value dynamically from properties where the key is absent; refactoring code that previously passed a constant and now passes a nullable variable.","solutions":["Pass ClientAuth.REQUIRED or ClientAuth.REQUEST explicitly.","If the value is dynamic, default it: ClientAuth mode = configured != null ? configured : ClientAuth.REQUIRED.","Fix the upstream producer that returns null (missing config key, uninitialized field)."],"exampleFix":"// before\nClientAuth auth = readFromConfig(); // may be null\nhttpSecurity.mTLS(auth); // throws\n// after\nClientAuth auth = readFromConfig();\nhttpSecurity.mTLS(auth != null ? auth : ClientAuth.REQUIRED);","handlingStrategy":"type-guard","validationCode":"if (clientAuth == null) {\n    clientAuth = ClientAuth.REQUIRED; // sensible default\n}\nhttpSecurity.mTLS(clientAuth);","typeGuard":"ClientAuth nonNullOrDefault(ClientAuth auth) {\n    return auth != null ? auth : ClientAuth.REQUIRED;\n}","tryCatchPattern":"try {\n    httpSecurity.mTLS(clientAuth);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"cannot be null\")) {\n        log.error(\"ClientAuth value missing; defaulting to REQUIRED\");\n        httpSecurity.mTLS(ClientAuth.REQUIRED);\n    } else {\n        throw e;\n    }\n}","preventionTips":["Default nullable ClientAuth inputs before calling mTLS().","Avoid reading ClientAuth from config without an @WithDefault/Optional fallback.","Keep ClientAuth constants final and initialized at declaration."],"tags":["quarkus","http-security","mtls","null-argument"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}