{"record":{"id":"e2e1d67f220273ae","repo":"quarkusio/quarkus","slug":"access-token-is-null","errorCode":null,"errorMessage":"Access token is null","messagePattern":"Access token is null","errorType":"exception","errorClass":"OidcClientException","httpStatus":null,"severity":"error","filePath":"extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java","lineNumber":129,"sourceCode":"        return getJsonResponse(OidcEndpoint.Type.TOKEN, tokenGrantParams, additionalGrantParameters, Operation.GET);\n    }\n\n    @Override\n    public Uni<Tokens> refreshTokens(String refreshToken, Map<String, String> additionalGrantParameters) {\n        checkClosed();\n        if (refreshToken == null) {\n            throw new OidcClientException(\"Refresh token is null\");\n        }\n        MultiMap refreshGrantParams = copyMultiMap(commonRefreshGrantParams);\n        refreshGrantParams.add(OidcConstants.REFRESH_TOKEN_VALUE, refreshToken);\n        return getJsonResponse(OidcEndpoint.Type.TOKEN, refreshGrantParams, additionalGrantParameters, Operation.REFRESH);\n    }\n\n    @Override\n    public Uni<Boolean> revokeAccessToken(String accessToken, Map<String, String> additionalParameters) {\n        checkClosed();\n        if (accessToken == null) {\n            throw new OidcClientException(\"Access token is null\");\n        }\n        OidcRequestContextProperties requestProps = getRequestProps(null);\n\n        if (tokenRevokeUri != null) {\n            MultiMap tokenRevokeParams = MultiMap.caseInsensitiveMultiMap();\n            tokenRevokeParams.set(OidcConstants.REVOCATION_TOKEN, accessToken);\n            return withAsyncCredentials().flatMap(asyncCredentials -> postRequest(requestProps,\n                    OidcEndpoint.Type.TOKEN_REVOCATION,\n                    client.postAbs(tokenRevokeUri), tokenRevokeParams, additionalParameters, Operation.REVOKE, asyncCredentials)\n                    .flatMap(resp -> toRevokeResponse(requestProps, resp)));\n        } else {\n            LOG.debugf(\"%s OidcClient can not revoke the access token because the revocation endpoint URL is not set\");\n            return Uni.createFrom().item(false);\n        }\n\n    }\n\n    private OidcRequestContextProperties getRequestProps(String grantType) {","sourceCodeStart":111,"sourceCodeEnd":147,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/oidc-client/runtime/src/main/java/io/quarkus/oidc/client/runtime/OidcClientImpl.java#L111-L147","documentation":"OidcClientImpl.revokeAccessToken() sends the access token as the revocation token parameter; a null token cannot be revoked, so the method fails fast with an OidcClientException before issuing the revocation request.","triggerScenarios":"Calling oidcClient.revokeAccessToken(null, additionalParameters) — commonly when the Tokens object being revoked has a null access token or a variable was never populated.","commonSituations":"Revoking tokens on logout where the access token was never obtained (e.g. only an ID token exists); passing the wrong field (refresh token absent / access token null) from a custom token store.","solutions":["Check the access token for null/blank before calling revokeAccessToken() and skip revocation if absent.","Pass the correct token field from your Tokens/store object.","If revocation of a null token should be a no-op, wrap the call in a null check instead of letting it throw."],"exampleFix":"// before\noidcClient.revokeAccessToken(tokens.getAccessToken(), Map.of());\n\n// after\nif (tokens.getAccessToken() != null) {\n    oidcClient.revokeAccessToken(tokens.getAccessToken(), Map.of());\n}","handlingStrategy":"type-guard","validationCode":"String at = tokens.getAccessToken();\nif (at == null || at.isBlank()) {\n    return; // nothing to revoke\n}","typeGuard":"boolean hasAccessToken(Tokens t) { return t != null && t.getAccessToken() != null && !t.getAccessToken().isBlank(); }","tryCatchPattern":"try {\n    return client.revokeAccessToken(at, params);\n} catch (OidcClientException e) {\n    if (e.getMessage().contains(\"Access token is null\")) {\n        return Uni.createFrom().item(false);\n    }\n    throw e;\n}","preventionTips":["Skip revocation when no access token was issued.","Log a warning instead of throwing on best-effort logout revocation.","Validate token store contents before logout flows."],"tags":["oidc-client","token-revocation","null-check"],"backgroundTag":"null-token-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}