What causes "Paths must not be empty" in quarkusio/quarkus?

Pass at least one non-empty path pattern, e.g. httpSecurity.path("/api/*").

quarkusio/quarkus · error · IllegalArgumentException

Paths must not be empty

Error message

Paths must not be empty

What it means

HttpSecurity.path(String...) creates a new HttpPermission for the given path patterns and starts a permission rule. Calling it with null or an empty array would create a meaningless permission, so Quarkus rejects it with an IllegalArgumentException. All convenience methods (get/put/post/delete) delegate to path(), so they fail the same way.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:206

        return mechanism(mTLSAuthenticationMechanism);
    }

    @Override
    public HttpSecurity mTLS(ClientAuth tlsClientAuth) {
        if (tlsClientAuth == null) {
            throw new IllegalArgumentException("Client authentication cannot be null");
        }
        return switch (tlsClientAuth) {
            case REQUIRED -> mechanism(MTLS.required());
            case REQUEST -> mechanism(MTLS.request());
            case NONE -> throw new IllegalArgumentException("Client authentication cannot be disabled with this API");
        };
    }

    @Override
    public HttpPermission path(String... patterns) {
        if (patterns == null || patterns.length == 0) {
            throw new IllegalArgumentException("Paths must not be empty");
        }
        var httpPermission = new HttpPermissionImpl(patterns);
        httpPermissions.add(httpPermission);
        return httpPermission;
    }

    @Override
    public HttpPermission get(String... paths) {
        return path(paths).methods("GET");
    }

    @Override
    public HttpPermission put(String... paths) {
        return path(paths).methods("PUT");
    }

    @Override
    public HttpPermission post(String... paths) {

View on GitHub (pinned to e1c734241f)

Solutions

Pass at least one non-empty path pattern, e.g. httpSecurity.path("/api/*").
Guard dynamic inputs: only call path()/get()/post() when the array has at least one element.
Fix the upstream collection that produced an empty pattern list.

Example fix

// before
String[] paths = loadPaths(); // may be empty
httpSecurity.get(paths); // throws
// after
String[] paths = loadPaths();
if (paths != null && paths.length > 0) {
    httpSecurity.get(paths);
}

Defensive patterns

Strategy: validation

Validate before calling

if (paths == null || paths.length == 0) {
    throw new IllegalStateException("At least one path pattern is required for an HttpPermission");
}
httpSecurity.path(paths);

Type guard

boolean hasPaths(String[] patterns) {
    return patterns != null && patterns.length > 0;
}

Try / catch

try {
    httpSecurity.get(paths);
} catch (IllegalArgumentException e) {
    if (e.getMessage().contains("Paths must not be empty")) {
        log.error("No paths supplied for permission rule; check path source (config/db)");
    } else {
        throw e;
    }
}

Prevention

Never call path()/get()/post()/put()/delete() with an empty or null array.
Validate dynamic path collections before building permissions.
Provide a fallback default path (e.g. "/api/*") when the source collection is empty, if appropriate.

When it happens

Trigger: Calling httpSecurity.path() or path(new String[0]); calling httpSecurity.get(paths) where paths is null/empty (e.g. a List.toArray() on an empty or null-origin list).

Common situations: Building path arrays dynamically from config or database where the collection is empty; refactoring that removed a default path constant; calling get(null) by mistake.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/575007e4f41938ac. Report an issue: GitHub.