{"record":{"id":"d71d6a59835bd68d","repo":"quarkusio/quarkus","slug":"cors-cannot-be-configured-both-programmatically-an","errorCode":null,"errorMessage":"CORS cannot be configured both programmatically and in the 'application.properties' file","messagePattern":"CORS cannot be configured both programmatically and in the 'application\\.properties' file","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":87,"sourceCode":"    }\n\n    @Override\n    public HttpSecurity cors(Set<String> origins) {\n        return cors(CORS.origins(origins).build());\n    }\n\n    @Override\n    public HttpSecurity cors(CORS cors) {\n        if (cors == null) {\n            throw new IllegalArgumentException(\"CORS must not be null\");\n        }\n        final boolean alreadyConfiguredInAppProps = corsConfig.accessControlAllowCredentials().isPresent()\n                || corsConfig.accessControlMaxAge().isPresent()\n                || corsConfig.headers().isPresent()\n                || corsConfig.methods().isPresent()\n                || corsConfig.exposedHeaders().isPresent();\n        if (alreadyConfiguredInAppProps) {\n            throw new IllegalStateException(\n                    \"CORS cannot be configured both programmatically and in the 'application.properties' file\");\n        }\n        final CORSConfig newCorsConfig = (CORSConfig) cors;\n        if (!corsConfig.origins().orElse(List.of()).isEmpty()) {\n            // for example SmallRye OpenAPI extension adds a management URL to 'origins'\n            // and we want users know that they are loosing some configuration\n            final List<String> newOrigins = newCorsConfig.origins().orElse(List.of());\n            final String missingOrigins = corsConfig.origins().get().stream()\n                    .filter(origin -> !newOrigins.contains(origin)).collect(Collectors.joining(\",\"));\n            if (!missingOrigins.isEmpty()) {\n                LOG.warnf(\n                        \"CORS are configured programmatically, but previously configured '%s' origins are missing in the new configuration\",\n                        missingOrigins);\n            }\n        }\n        corsConfig = newCorsConfig;\n        return this;\n    }","sourceCodeStart":69,"sourceCodeEnd":105,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L69-L105","documentation":"CORS was configured both programmatically via HttpSecurity.cors(...) and statically via quarkus.http.cors.* properties in application.properties. Quarkus forbids the double configuration to avoid silently dropping one of them and throws IllegalStateException.","triggerScenarios":"Calling cors() programmatically while application.properties already sets any of quarkus.http.cors.access-control-allow-credentials, access-control-max-age, headers, methods, or exposed-headers (alreadyConfiguredInAppProps == true).","commonSituations":"Migrating from properties-based CORS to programmatic CORS without deleting the old properties; examples/docs mixing both approaches; a framework/extension (e.g. SmallRye OpenAPI adding management origins) that populated origins and user code adding cors() too.","solutions":["Remove the quarkus.http.cors.* entries from application.properties and configure CORS exclusively programmatically.","Or drop the programmatic cors() call and keep the properties-based configuration.","Search all config sources (application.properties, application.yaml, env vars like QUARKUS_HTTP_CORS_*) for CORS keys.","Verify with dev mode startup that only one configuration source remains."],"exampleFix":"// before\n# application.properties\nquarkus.http.cors=true\nquarkus.http.cors.origins=*\n// plus programmatic httpSecurity.cors(CORS.origins(\"https://app.example.com\").build())\n// after: keep only one source\nhttpSecurity.cors(CORS.origins(\"https://app.example.com\").build());\n// and delete quarkus.http.cors.* from application.properties","handlingStrategy":"validation","validationCode":"boolean propsConfigured = ConfigProvider.getConfig().getOptionalValue(\"quarkus.http.cors.origins\", String.class).isPresent();\nif (propsConfigured) {\n    throw new IllegalStateException(\"Remove quarkus.http.cors.* before configuring CORS programmatically\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pick ONE configuration style: properties OR programmatic","Grep all config sources (properties, yaml, env vars) for quarkus.http.cors before adding programmatic config","Document CORS location in the team's configuration conventions"],"tags":["cors","configuration","security","quarkus","conflict"],"backgroundTag":"duplicate-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}