quarkusio/quarkus · error · IllegalArgumentException

Argument 'origin' cannot be null

Error message

Argument 'origin' cannot be null

What it means

CORS.Builder.origin(String) rejects a null argument with an IllegalArgumentException before delegating to origins(Set.of(origin)). A null is not a valid origin for the Access-Control-Allow-Origin configuration.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/security/CORS.java:166

        }

        /**
         * @param newMethods {@link CORSConfig#methods()}
         * @return this builder
         */
        public Builder methods(Set<String> newMethods) {
            this.methods = merge(this.methods, newMethods, "Methods");
            return this;
        }

        /**
         * This method is a shortcut for {@code origins(Set.of(origin))}.
         *
         * @return this builder
         */
        public Builder origin(String origin) {
            if (origin == null) {
                throw new IllegalArgumentException("Argument 'origin' cannot be null");
            }
            return origins(Set.of(origin));
        }

        /**
         * @param newOrigins {@link CORSConfig#origins()}
         * @return this builder
         */
        public Builder origins(Set<String> newOrigins) {
            this.origins = merge(this.origins, newOrigins, "Origins");
            return this;
        }

        /**
         * @param returnExactOrigins {@link CORSConfig#returnExactOrigins()}
         * @return this builder
         */
        public Builder returnExactOrigins(boolean returnExactOrigins) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a non-null origin string (e.g. "https://example.com")
2. Null-check or use an Optional before calling
3. Set the origins via config instead of code

Example fix

// before
builder.origin(System.getenv("ALLOWED_ORIGIN"));
// after
String origin = System.getenv("ALLOWED_ORIGIN");
if (origin != null) {
    builder.origin(origin);
}

if (origin == null) { throw new IllegalStateException("Allowed origin must be configured before builder.origin()"); }

boolean isValidOrigin(String o) { return o != null && o.startsWith("http"); }

When it happens

Trigger: Calling CORS.builder().origin(null), commonly when origins are read from config, a database, or a request-derived value.

Common situations: Empty/missing quarkus.http.cors origins config; null return from a hostname/origin resolution helper.

Related errors

• Argument 'exposedHeader' cannot be null
• Argument 'header' cannot be null
• Argument 'method' cannot be null
• ${what} must not be null
• The `mails` parameter must not be `null`

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d23c43f8f4cf1f7a. Report an issue: GitHub.