quarkusio/quarkus · error · IllegalArgumentException

Argument 'method' cannot be null

Error message

Argument 'method' cannot be null

What it means

CORS.Builder.method(String) rejects a null argument with an IllegalArgumentException before delegating to methods(Set.of(method)). A null is not a valid HTTP method for the Access-Control-Allow-Methods configuration.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java:145

        }

        /**
         * @param newHeaders {@link CORSConfig#headers()}
         * @return this builder
         */
        public Builder headers(Set<String> newHeaders) {
            this.headers = merge(this.headers, newHeaders, "Headers");
            return this;
        }

        /**
         * This method is a shortcut for {@code methods(Set.of(method))}.
         *
         * @return this builder
         */
        public Builder method(String method) {
            if (method == null) {
                throw new IllegalArgumentException("Argument 'method' cannot be null");
            }
            return methods(Set.of(method));
        }

        /**
         * @param newMethods {@link CORSConfig#methods()}
         * @return this builder
         */
        public Builder methods(Set<String> newMethods) {
            this.methods = merge(this.methods, newMethods, "Methods");
            return this;
        }

        /**
         * This method is a shortcut for {@code origins(Set.of(origin))}.
         *
         * @return this builder
         */

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-null HTTP method name (e.g. "POST")
2. Null-check the value before calling
3. Validate the config source supplying the method name

Example fix

// before
builder.method(props.getProperty("method"));
// after
String m = props.getProperty("method");
if (m != null) {
    builder.method(m);
}

if (method == null) { throw new IllegalStateException("HTTP method must be configured before builder.method()"); }

boolean isValidMethod(String m) { return m != null && m.matches("[A-Z]+(,[A-Z]+)*"); }

When it happens

Trigger: Calling CORS.builder().method(null), often when method names are derived from config or user input.

Common situations: Unset config entries; splitting/parsing a method list that yields a null element; misordered builder arguments.

Related errors

• Argument 'exposedHeader' cannot be null
• Argument 'header' cannot be null
• Argument 'origin' cannot be null
• ${what} must not be null
• The `mails` parameter must not be `null`

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c1e9fc93630380fd. Report an issue: GitHub.