quarkusio/quarkus · error · IllegalArgumentException

Permissions must not be empty

Error message

Permissions must not be empty

What it means

The PathPolicy's permissions(Permission...) method rejects a null or zero-length varargs array with IllegalArgumentException. It wraps the given io.quarkus.security.permission.Permission objects in a PermissionsHttpSecurityPolicy for the current path; a permission set with no entries would produce a policy that grants nothing, so the library fails fast instead.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:320

                throw new IllegalArgumentException("Roles must not be empty");
            }
            if (roleToRoles == null) {
                throw new IllegalArgumentException("Role to roles mapping must not be null");
            }
            this.policy = new Policy(null, new RolesAllowedHttpSecurityPolicy(Arrays.asList(roles), null, roleToRoles));
            return HttpSecurityImpl.this;
        }

        @Override
        public HttpSecurity roles(String... roles) {
            return roles(Map.of(), roles);
        }

        @Override
        public HttpSecurity permissions(Permission... permissions) {
            validatePolicyNotSetYet();
            if (permissions == null || permissions.length == 0) {
                throw new IllegalArgumentException("Permissions must not be empty");
            }
            policy = new Policy(null, new PermissionsHttpSecurityPolicy(permissions));
            return HttpSecurityImpl.this;
        }

        @Override
        public HttpSecurity permissions(String... permissionNames) {
            Objects.requireNonNull(permissionNames);
            StringPermission[] stringPermissions = new StringPermission[permissionNames.length];
            for (int i = 0; i < permissionNames.length; i++) {
                stringPermissions[i] = new StringPermission(permissionNames[i]);
            }
            return permissions(stringPermissions);
        }

        @Override
        public HttpSecurity policy(HttpSecurityPolicy httpSecurityPolicy) {
            validatePolicyNotSetYet();

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass at least one Permission instance, e.g. .permissions(new Permission("read", "resource")).
2. Only attach the permissions policy when at least one permission exists; otherwise choose permit/authenticated.
3. Inspect the code producing the Permission[] - guard against empty collections before toArray.

Example fix

// before
Permission[] perms = loadPermissions(); // may be empty
httpSecurity.path("/admin/*").permissions(perms);
// after
if (perms != null && perms.length > 0) {
    httpSecurity.path("/admin/*").permissions(perms);
}

if (permissions != null && permissions.length > 0) {
    httpSecurity.path(path).permissions(permissions);
}

static boolean hasPermissions(Permission... permissions) {
    return permissions != null && permissions.length > 0;
}

try {
    httpSecurity.path("/admin/*").permissions(perms);
} catch (IllegalArgumentException e) {
    log.error("permissions() requires at least one Permission: " + e.getMessage());
}

When it happens

Trigger: httpSecurity.path("/admin/*").permissions() with no arguments; .permissions(collectedPermissions) where the collection toArray result was empty; .permissions((Permission[]) null).

Common situations: Building permission-based security where permissions are loaded from a store/config and none matched the path; conditional permission construction that skipped all permission creation; migrating from annotation-based @PermissionsAllowed to programmatic setup and forgetting to add the actual permission objects.

Related errors

• Roles must not be empty
• Source role must not be empty
• Target roles for role '%s' must not be empty
• Source role must not be null
• Target roles for role '%s' must not be null

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/c1456309764ad0ce. Report an issue: GitHub.