{"record":{"id":"ecf3b68c26542c31","repo":"quarkusio/quarkus","slug":"invalid-username-usernameheader","errorCode":null,"errorMessage":"Invalid username: \" + usernameHeader","messagePattern":"Invalid username: \" \\+ usernameHeader","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":500,"severity":"error","filePath":"integration-tests/elytron-security-jdbc/src/main/java/io/quarkus/elytron/security/jdbc/it/JdbcPermissionChecker.java","lineNumber":27,"sourceCode":"import jakarta.inject.Inject;\nimport jakarta.transaction.Transactional;\n\nimport io.agroal.api.AgroalDataSource;\nimport io.quarkus.security.PermissionChecker;\n\n@ApplicationScoped\npublic class JdbcPermissionChecker {\n\n    @Inject\n    AgroalDataSource defaultDataSource;\n\n    @Transactional\n    @PermissionChecker(\"admin-role-in-db\")\n    boolean hasAdminRole(String usernameHeader) {\n        String username = switch (usernameHeader) {\n            case \"admin\" -> \"admin\";\n            case \"user\" -> \"user\";\n            default -> throw new IllegalArgumentException(\"Invalid username: \" + usernameHeader);\n        };\n        try (Connection connection = defaultDataSource.getConnection(); Statement stat = connection.createStatement()) {\n            try (ResultSet roleQuery = stat\n                    .executeQuery(\"select u.role from test_user u where u.username='\" + username + \"'\")) {\n                if (!roleQuery.first()) {\n                    throw new IllegalStateException(\"Username '%s' not in the 'test_user' table\".formatted(username));\n                }\n                var role = roleQuery.getString(1);\n                return \"admin\".equals(role);\n            }\n        } catch (SQLException e) {\n            throw new RuntimeException(e);\n        }\n    }\n}\n","sourceCodeStart":9,"sourceCodeEnd":43,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/elytron-security-jdbc/src/main/java/io/quarkus/elytron/security/jdbc/it/JdbcPermissionChecker.java#L9-L43","documentation":"IllegalArgumentException thrown by JdbcPermissionChecker.hasAdminRole(), a @PermissionChecker used for @PermissionAction-based authorization. The username header supplied to the permission check is not one of the recognized values (\"admin\" or \"user\"), so the switch's default arm rejects it. It guards against arbitrary/unexpected header values reaching the SQL lookup.","triggerScenarios":"Request supplies a usernameHeader value other than \"admin\" or \"user\" (or no header at all, making it null), causing the switch default to throw before the JDBC query runs.","commonSituations":"Test client forgetting to set the username header; header spelled differently or with whitespace/case mismatch; new expected users not added to the switch; header consumed by a proxy.","solutions":["Send the expected username header value (\"admin\" or \"user\") with the request","Extend the switch to handle additional valid usernames if the test adds users","Null-check/normalize (trim) the header value before the switch","Check header name casing and any proxy stripping of custom headers"],"exampleFix":"// before\ndefault -> throw new IllegalArgumentException(\"Invalid username: \" + usernameHeader);\n// after\nif (usernameHeader == null) {\n    throw new IllegalArgumentException(\"Missing username header\");\n}\nString normalized = usernameHeader.trim();\ndefault -> throw new IllegalArgumentException(\"Invalid username: \" + normalized);","handlingStrategy":"validation","validationCode":"if (usernameHeader == null || !(usernameHeader.equals(\"admin\") || usernameHeader.equals(\"user\"))) {\n    throw new BadRequestException(\"username header must be 'admin' or 'user'\");\n}","typeGuard":"boolean isValidUsername(String u) {\n    return \"admin\".equals(u) || \"user\".equals(u);\n}","tryCatchPattern":"try {\n    return checkPermission(header);\n} catch (IllegalArgumentException e) {\n    throw new ForbiddenException(e.getMessage());\n}","preventionTips":["Validate/normalize header values before the switch","Keep the allowlist of accepted usernames in one constant","Cover the default arm with a unit test using an unexpected username"],"tags":["security","jdbc","permission-checker","validation"],"backgroundTag":"invalid-username-header","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}