{"record":{"id":"dee0a6c87ceaf94d","repo":"quarkusio/quarkus","slug":"path-must-always-start-with-a-path-separator-but","errorCode":null,"errorMessage":"Path must always start with a path separator, but was '' created from original path pattern ''","messagePattern":"Path must always start with a path separator, but was '' created from original path pattern ''","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java","lineNumber":249,"sourceCode":"         */\n        public ImmutablePathMatcherBuilder<T> addPath(String path, T handler) {\n            if (empty) {\n                empty = false;\n            }\n            path = path.trim();\n            if (rootPath != null && !path.startsWith(\"/\")) {\n                path = rootPath + path;\n            }\n            return addPath(path, path, handler);\n        }\n\n        private ImmutablePathMatcherBuilder<T> addPath(String originalPath, String path, T handler) {\n            if (!path.startsWith(\"/\")) {\n                String errMsg = \"Path must always start with a path separator, but was '\" + path + \"'\";\n                if (!originalPath.equals(path)) {\n                    errMsg += \" created from original path pattern '\" + originalPath + \"'\";\n                }\n                throw new IllegalArgumentException(errMsg);\n            }\n            final int wildcardIdx = path.indexOf('*');\n            if (wildcardIdx == -1) {\n                addExactPath(path, handler);\n            } else {\n                addWildcardPath(path, handler, wildcardIdx, originalPath);\n            }\n            return this;\n        }\n\n        private void addWildcardPath(String path, T handler, int wildcardIdx, String originalPath) {\n            final int lastIdx = path.length() - 1;\n            final String pathWithWildcard;\n            final String pathAfter1stWildcard;\n\n            if (lastIdx == wildcardIdx) {\n                // ends with a wildcard => it's a prefix path\n                pathWithWildcard = path;","sourceCodeStart":231,"sourceCodeEnd":267,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java#L231-L267","documentation":"Quarkus HTTP security path matching requires every registered permission path to be absolute, i.e. it must begin with '/'. The ImmutablePathMatcher builder validates this when a path (possibly produced by normalizing an original pattern) is added; if it does not start with a separator it throws IllegalArgumentException. When the failing path differs from the original configured pattern, both are included in the message to help locate the misconfiguration.","triggerScenarios":"Registering a path into ImmutablePathMatcherBuilder via addPath where the (possibly rewritten) path string is empty or does not start with '/', e.g. quarkus.http.auth.permission.<name>.paths=foo/* or a blank/relative entry in application.properties.","commonSituations":"Typos in quarkus.http.auth.permission paths config (missing leading slash), paths generated programmatically from relative values, or empty string after removing a prefix from a configured pattern.","solutions":["Add a leading '/' to every path in the permission's paths list (e.g. paths=/foo/*).","If the path is built programmatically, ensure the result is absolute before calling addPath (prepend '/' when missing).","Check the original pattern in the message: fix the source configuration so normalization does not yield an empty/relative path."],"exampleFix":"// before (application.properties)\nquarkus.http.auth.permission.public.paths=api/*\n// after\nquarkus.http.auth.permission.public.paths=/api/*","handlingStrategy":"validation","validationCode":"boolean isAbsoluteHttpPath(String p) { return p != null && p.startsWith(\"/\"); }\n// check every quarkus.http.auth.permission.<name>.paths entry before deployment","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always write permission paths with a leading slash","Validate application.properties permission paths in a startup test","Search config for paths= entries not starting with '/'"],"tags":["quarkus","http-security","configuration","path"],"backgroundTag":"path-must-start-with-separator","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}