quarkusio/quarkus · error · IllegalArgumentException

Argument 'header' cannot be null

Error message

Argument 'header' cannot be null

What it means

Thrown by CORS.Builder.header(String) when a null single header value is passed to the shortcut that delegates to headers(Set.of(header)). Set.of rejects nulls indirectly; the explicit null check names the offending 'header' argument up front. The sibling merge(...) helper performs the equivalent validation for the set-based methods (e.g. exposedHeaders), which report their own argument names.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java:124

        }

        /**
         * @param exposedHeaders {@link CORSConfig#exposedHeaders()}
         * @return this builder
         */
        public Builder exposedHeaders(Set<String> exposedHeaders) {
            this.exposedHeaders = merge(this.exposedHeaders, exposedHeaders, "Exposed headers");
            return this;
        }

        /**
         * This method is a shortcut for {@code headers(Set.of(header))}.
         *
         * @return this builder
         */
        public Builder header(String header) {
            if (header == null) {
                throw new IllegalArgumentException("Argument 'header' cannot be null");
            }
            return headers(Set.of(header));
        }

        /**
         * @param newHeaders {@link CORSConfig#headers()}
         * @return this builder
         */
        public Builder headers(Set<String> newHeaders) {
            this.headers = merge(this.headers, newHeaders, "Headers");
            return this;
        }

        /**
         * This method is a shortcut for {@code methods(Set.of(method))}.
         *
         * @return this builder
         */

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-null header name string
2. Null-check or skip the call when the value is absent
3. Provide a default header name in config

Example fix

// before
builder.header(cfg.allowHeader());
// after
Optional.ofNullable(cfg.allowHeader()).ifPresent(builder::header);

Objects.requireNonNull(header, "header must not be null before CORS.builder().header()");

boolean isValidHeader(String s) { return s != null && !s.isBlank(); }

When it happens

Trigger: Calling CORS.builder().header(null), usually from a nullable variable or a lookup that failed.

Common situations: Config values or map lookups returning null; conditional code paths where the header name was never initialized.

Related errors

• Argument 'exposedHeader' cannot be null
• Argument 'method' cannot be null
• Argument 'origin' cannot be null
• ${what} must not be null
• The `mails` parameter must not be `null`

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f08bce0cdb1e579f. Report an issue: GitHub.