quarkusio/quarkus · error · IllegalArgumentException

Permissions must not be empty

Error message

Permissions must not be empty

What it means

The PathPolicy's permissions(Permission...) method rejects a null or zero-length varargs array with IllegalArgumentException. It wraps the given io.quarkus.security.permission.Permission objects in a PermissionsHttpSecurityPolicy for the current path; a permission set with no entries would produce a policy that grants nothing, so the library fails fast instead.

Solutions

1. Pass at least one Permission instance, e.g. .permissions(new Permission("read", "resource")).
2. Only attach the permissions policy when at least one permission exists; otherwise choose permit/authenticated.
3. Inspect the code producing the Permission[] - guard against empty collections before toArray.

Example fix

// before
Permission[] perms = loadPermissions(); // may be empty
httpSecurity.path("/admin/*").permissions(perms);
// after
if (perms != null && perms.length > 0) {
    httpSecurity.path("/admin/*").permissions(perms);
}

if (permissions != null && permissions.length > 0) {
    httpSecurity.path(path).permissions(permissions);
}

static boolean hasPermissions(Permission... permissions) {
    return permissions != null && permissions.length > 0;
}

try {
    httpSecurity.path("/admin/*").permissions(perms);
} catch (IllegalArgumentException e) {
    log.error("permissions() requires at least one Permission: " + e.getMessage());
}

When it happens

Trigger: httpSecurity.path("/admin/*").permissions() with no arguments; .permissions(collectedPermissions) where the collection toArray result was empty; .permissions((Permission[]) null).

Common situations: Building permission-based security where permissions are loaded from a store/config and none matched the path; conditional permission construction that skipped all permission creation; migrating from annotation-based @PermissionsAllowed to programmatic setup and forgetting to add the actual permission objects.

Related errors

• HttpSecurityPolicy must not be null
• Role to roles mapping must not be null
• Roles must not be empty
• Source role must not be empty
• Source role must not be null

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c1456309764ad0ce. Report an issue: GitHub.

Appendix: source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:320

                throw new IllegalArgumentException("Roles must not be empty");
            }
            if (roleToRoles == null) {
                throw new IllegalArgumentException("Role to roles mapping must not be null");
            }
            this.policy = new Policy(null, new RolesAllowedHttpSecurityPolicy(Arrays.asList(roles), null, roleToRoles));
            return HttpSecurityImpl.this;
        }

        @Override
        public HttpSecurity roles(String... roles) {
            return roles(Map.of(), roles);
        }

        @Override
        public HttpSecurity permissions(Permission... permissions) {
            validatePolicyNotSetYet();
            if (permissions == null || permissions.length == 0) {
                throw new IllegalArgumentException("Permissions must not be empty");
            }
            policy = new Policy(null, new PermissionsHttpSecurityPolicy(permissions));
            return HttpSecurityImpl.this;
        }

        @Override
        public HttpSecurity permissions(String... permissionNames) {
            Objects.requireNonNull(permissionNames);
            StringPermission[] stringPermissions = new StringPermission[permissionNames.length];
            for (int i = 0; i < permissionNames.length; i++) {
                stringPermissions[i] = new StringPermission(permissionNames[i]);
            }
            return permissions(stringPermissions);
        }

        @Override
        public HttpSecurity policy(HttpSecurityPolicy httpSecurityPolicy) {
            validatePolicyNotSetYet();

View on GitHub (pinned to e1c734241f)