{"record":{"id":"dc167db0ec7d1d17","repo":"quarkusio/quarkus","slug":"csrf-must-not-be-null","errorCode":null,"errorMessage":"CSRF must not be null","messagePattern":"CSRF must not be null","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":110,"sourceCode":"            // for example SmallRye OpenAPI extension adds a management URL to 'origins'\n            // and we want users know that they are loosing some configuration\n            final List<String> newOrigins = newCorsConfig.origins().orElse(List.of());\n            final String missingOrigins = corsConfig.origins().get().stream()\n                    .filter(origin -> !newOrigins.contains(origin)).collect(Collectors.joining(\",\"));\n            if (!missingOrigins.isEmpty()) {\n                LOG.warnf(\n                        \"CORS are configured programmatically, but previously configured '%s' origins are missing in the new configuration\",\n                        missingOrigins);\n            }\n        }\n        corsConfig = newCorsConfig;\n        return this;\n    }\n\n    @Override\n    public HttpSecurity csrf(CSRF csrf) {\n        if (csrf == null) {\n            throw new IllegalArgumentException(\"CSRF must not be null\");\n        }\n        this.csrf = csrf;\n        return this;\n    }\n\n    @Override\n    public HttpSecurity mechanism(HttpAuthenticationMechanism mechanism) {\n        Objects.requireNonNull(mechanism);\n        if (mechanism.getClass() == FormAuthenticationMechanism.class) {\n            final FormAuthConfig defaults = HttpSecurityUtils.getDefaultAuthConfig().auth().form();\n            final FormAuthConfig actualConfig = vertxHttpConfig.auth().form();\n            if (!actualConfig.equals(defaults)) {\n                throw new IllegalArgumentException(\"Cannot configure form-based authentication programmatically \"\n                        + \"because it has already been configured in the 'application.properties' file\");\n            }\n        } else if (mechanism.getClass() == BasicAuthenticationMechanism.class) {\n            String actualRealm = vertxHttpConfig.auth().realm().orElse(null);\n            if (actualRealm != null) {","sourceCodeStart":92,"sourceCodeEnd":128,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L92-L128","documentation":"HttpSecurity.csrf(CSRF) stores the programmatic CSRF configuration on the HttpSecurity builder. The Quarkus HTTP security API rejects null arguments eagerly so that a misconfigured builder fails fast instead of silently skipping CSRF protection. Throwing here prevents a null CSRF object from flowing into security runtime setup where the failure would be much harder to diagnose.","triggerScenarios":"Calling httpSecurity.csrf(null) directly, or passing a variable/field that resolves to null (e.g. a conditionally-built CSRF instance or an uninitialized supplier result) to csrf().","commonSituations":"Developers building security configuration dynamically in code where the CSRF config is produced by a factory that can return null on some code paths, or refactoring code where a CSRF constant was removed and the variable now defaults to null.","solutions":["Pass a non-null CSRF instance, e.g. httpSecurity.csrf(CSRF.defaultInstance()) or a properly built CSRF object.","Guard the call: only invoke csrf(...) when the CSRF object is non-null, and otherwise rely on configuration-file CSRF settings.","Check the producer of the CSRF value (factory/supplier/config) for a code path returning null and fix it."],"exampleFix":"// before\nCSRF csrf = loadCsrfConfig(); // may return null\nhttpSecurity.csrf(csrf);\n// after\nCSRF csrf = loadCsrfConfig();\nif (csrf != null) {\n    httpSecurity.csrf(csrf);\n}","handlingStrategy":"validation","validationCode":"if (csrf == null) {\n    throw new IllegalStateException(\"CSRF config must be built before HttpSecurity.csrf() is called\");\n}\nhttpSecurity.csrf(csrf);","typeGuard":"boolean isUsableCsrf(CSRF csrf) {\n    return csrf != null;\n}","tryCatchPattern":"try {\n    httpSecurity.csrf(csrf);\n} catch (IllegalArgumentException e) {\n    if (e.getMessage().contains(\"CSRF must not be null\")) {\n        log.error(\"CSRF configuration missing; defaulting to config-file CSRF settings\");\n    } else {\n        throw e;\n    }\n}","preventionTips":["Build the CSRF object with a factory that never returns null (throw inside the factory instead).","Use Objects.requireNonNull(csrf) at call sites to fail at the earliest point.","Avoid nullable CSRF fields; initialize them eagerly."],"tags":["quarkus","http-security","csrf","null-argument"],"backgroundTag":"null-argument-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}