quarkusio/quarkus · error · IllegalArgumentException

HTTP methods must not be null or empty

Error message

HTTP methods must not be null or empty

What it means

Thrown by HttpPermission.methods(String...) when the varargs array is null or has zero elements. Restricting a permission to specific HTTP methods requires at least one method name; otherwise the restriction would be meaningless, so IllegalArgumentException is thrown.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:486

            return this;
        }

        @Override
        public HttpPermission shared() {
            this.shared = true;
            return this;
        }

        @Override
        public HttpPermission applyToJaxRs() {
            this.applyToJaxRs = true;
            return this;
        }

        @Override
        public HttpPermission methods(String... httpMethods) {
            if (httpMethods == null || httpMethods.length == 0) {
                throw new IllegalArgumentException("HTTP methods must not be null or empty");
            }
            this.methods = Arrays.copyOf(httpMethods, httpMethods.length);
            return this;
        }

        @Override
        public AuthorizationPolicy authorization() {
            validateAuthorizationNotSetYet();
            this.authorizationPolicy = new AuthorizationPolicy();
            return authorizationPolicy;
        }

        @Override
        public HttpSecurity permit() {
            return authorization().permit();
        }

        @Override

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass at least one method, e.g. .methods("GET", "POST").
2. Guard with (httpMethods != null && httpMethods.length > 0) and skip methods() (allowing all methods) when empty.
3. Fix the config/default so the method list is populated.

Example fix

// before
String[] ms = config.allowedMethods(); // may be empty
httpSecurity.paths("/api/*").permitAll().methods(ms); // throws when empty
// after
if (ms != null && ms.length > 0) {
    httpSecurity.paths("/api/*").permitAll().methods(ms);
}

if (httpMethods == null || httpMethods.length == 0) throw new IllegalArgumentException("at least one HTTP method required");

static boolean hasMethods(String... ms) { return ms != null && ms.length > 0; }

try { perm.methods(methods); } catch (IllegalArgumentException e) { if (!e.getMessage().contains("HTTP methods must not be null or empty")) throw e; }

When it happens

Trigger: Calling .methods() with no arguments, .methods(null), or spreading an empty/null String[] built from config or request data.

Common situations: Passing a dynamically built list of allowed methods that ended up empty; a config property like quarkus.http.auth...methods unset and mapped to an empty array; generic wrapper code forwarding varargs blindly.

Related errors

• name cannot be null
• Either location or predicate must be set
• At least one package name must be specified
• Key cannot be null
• Parameter 'mode' was set to '<mode>' while expected one of '

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/797682f2ecb6e97c. Report an issue: GitHub.