quarkusio/quarkus · error · IllegalArgumentException

Argument 'exposedHeader' cannot be null

Error message

Argument 'exposedHeader' cannot be null

What it means

CORS.Builder.exposedHeader(String) rejects a null argument with an IllegalArgumentException before delegating to exposedHeaders(Set.of(exposedHeader)). The builder enforces non-null values because a null exposed header name is meaningless in the Access-Control-Expose-Headers configuration.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java:103

        }

        /**
         * @param accessControlAllowCredentials {@link CORSConfig#accessControlAllowCredentials()}
         * @return this builder
         */
        public Builder accessControlAllowCredentials(boolean accessControlAllowCredentials) {
            this.accessControlAllowCredentials = Optional.of(accessControlAllowCredentials);
            return this;
        }

        /**
         * This method is a shortcut for {@code exposedHeaders(Set.of(exposedHeader))}.
         *
         * @return this builder
         */
        public Builder exposedHeader(String exposedHeader) {
            if (exposedHeader == null) {
                throw new IllegalArgumentException("Argument 'exposedHeader' cannot be null");
            }
            return exposedHeaders(Set.of(exposedHeader));
        }

        /**
         * @param exposedHeaders {@link CORSConfig#exposedHeaders()}
         * @return this builder
         */
        public Builder exposedHeaders(Set<String> exposedHeaders) {
            this.exposedHeaders = merge(this.exposedHeaders, exposedHeaders, "Exposed headers");
            return this;
        }

        /**
         * This method is a shortcut for {@code headers(Set.of(header))}.
         *
         * @return this builder
         */

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-null header name string to exposedHeader()
2. Check the value for null before calling, or skip the call when absent
3. Fix the upstream source (config property, env var) so it yields a real value

Example fix

// before
String name = config.getValue("exposed");
builder.exposedHeader(name);
// after
if (name != null) {
    builder.exposedHeader(name);
}

if (exposedHeader == null) { throw new IllegalStateException("exposedHeader name must be configured before calling builder.exposedHeader()"); }

boolean isValidHeader(String s) { return s != null && !s.isBlank(); }

When it happens

Trigger: Calling CORS.builder().exposedHeader(null) — typically when the header name comes from a nullable variable, config property, or map lookup that returned null.

Common situations: Reading header names from configuration or environment variables that are unset; passing the result of a null-returning lookup; chaining builders with optional values without defaulting.

Related errors

• Argument 'header' cannot be null
• Argument 'method' cannot be null
• Argument 'origin' cannot be null
• ${what} must not be null
• The `mails` parameter must not be `null`

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/04b3bfa48a35e9f9. Report an issue: GitHub.