quarkusio/quarkus · error · IllegalArgumentException

Path not specified

Error message

Path not specified

What it means

ImmutablePathMatcher's addExactPath requires a non-empty path string. An empty string is not a valid exact path to register, so it throws IllegalArgumentException('Path not specified'). This typically surfaces when a configured pattern normalized down to an empty string.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java:306

                String stripped = pathWithWildcard.substring(0, pathWithWildcard.length() - 2);
                pathWithoutWildcard = stripped.isEmpty() ? "/" : stripped;
            } else {
                // remove *
                pathWithoutWildcard = pathWithWildcard.substring(0, pathWithWildcard.length() - 1);
            }

            Path<T> p = pathsWithWildcard.computeIfAbsent(pathWithoutWildcard, Path::new);
            p.originalPath = originalPath;
            if (pathAfter1stWildcard == null) {
                p.addPrefixPath(handler, handlerAccumulator);
            } else {
                p.addPathWithInnerWildcard(pathAfter1stWildcard, handler);
            }
        }

        private void addExactPath(final String path, final T handler) {
            if (path.isEmpty()) {
                throw new IllegalArgumentException("Path not specified");
            }
            if (exactPathMatches.containsKey(path) && handlerAccumulator != null) {
                handlerAccumulator.accept(exactPathMatches.get(path), handler);
            } else {
                exactPathMatches.put(path, handler);
            }
            // when 'path.equals("/api/hello")' then the other path is '/api/hello/'
            final String otherPath;
            if (path.endsWith(STRING_PATH_SEPARATOR)) {
                if (path.length() == 1) {
                    // path '/' is only valid option, '' is not allowed
                    return;
                }
                // drop path separator
                otherPath = path.substring(0, path.length() - 1);
            } else {
                otherPath = path + STRING_PATH_SEPARATOR;
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Provide at least one concrete path such as paths=/* for root-wide matching (use '/*' rather than an empty value).
2. Remove the empty permission entry from application.properties if it was unintentional.
3. In code, guard addPath calls: skip or substitute "/" when the computed path is empty.

Example fix

// before (application.properties)
quarkus.http.auth.permission.public.paths=
// after
quarkus.http.auth.permission.public.paths=/*

if (paths == null || paths.isEmpty() || paths.stream().anyMatch(String::isBlank)) {
  throw new IllegalStateException("permission paths must contain at least one non-blank path");
}

When it happens

Trigger: Calling addExactPath with an empty string, which happens via addPath when a permission path is blank or becomes empty after stripping a wildcard/prefix, e.g. quarkus.http.auth.permission.x.paths= (empty) or paths=* alone.

Common situations: Empty quarkus.http.auth.permission paths property, config placeholders resolving to empty string, or code that strips a leading segment leaving nothing behind.

Related errors

• Path must always start with a path separator, but was '' cre
• Specified path can not be empty
• TLS client authentication is not available, please enable it
• HTTP permission path '' contains inner wildcard enclosed wit
• HttpSecurityPolicy that applies to JAXRS can be effective on

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/83a086b003745c16. Report an issue: GitHub.