quarkusio/quarkus · error · IllegalStateException

${prefix}.username and ${prefix}.password must be both set o

Error message

${prefix}.username and ${prefix}.password must be both set or both unset

What it means

This IllegalStateException is thrown by Quarkus's ProxyConfigurationRecorder during application build when a proxy configuration (quarkus.proxy."name".username / .password) has exactly one of the two credential properties set. Quarkus requires proxy credentials to be either fully configured or fully absent; a half-configured proxy would silently misbehave at runtime, so it fails the build fast instead.

Source

Thrown at extensions/proxy-registry/runtime/src/main/java/io/quarkus/proxy/runtime/ProxyConfigurationRecorder.java:89

            if (config.nonProxyHosts().isPresent()) {
                badValues.add("non-proxy-hosts");
            }
            if (config.proxyConnectTimeout().isPresent()) {
                badValues.add("proxy-connect-timeout");
            }
            if (badValues.length() > 0) {
                throw new IllegalStateException(
                        "If " + prefix + ".host is not set, then all of " + badValues + " must not be set either");
            }
            return Optional.empty();
        }

        if (config.port().isEmpty()) {
            throw new IllegalStateException("If " + prefix + ".host is set, " + prefix + ".port must also be set");
        }

        if (config.username().isPresent() != config.password().isPresent()) {
            throw new IllegalStateException(prefix + ".username and " + prefix + ".password must be both set or both unset");
        }

        Optional<String> username;
        Optional<String> password;
        if (config.username().isPresent() && config.password().isPresent()) {
            username = config.username();
            password = config.password();
        } else {
            ProxyConfig.ProxyCredentialProviderConfig providerConfig = config.credentialsProvider();
            if (providerConfig.name().isPresent()) {
                CredentialsProvider provider = CredentialsProviderFinder.find(providerConfig.beanName().orElse(null));
                Map<String, String> credentials = provider.getCredentialsAsync(providerConfig.name().get())
                        .await().indefinitely();
                username = Optional.ofNullable(credentials.get(providerConfig.usernameKey()));
                password = Optional.ofNullable(credentials.get(providerConfig.passwordKey()));
                if (username.isEmpty() || password.isEmpty()) {
                    StringJoiner missingKeys = new StringJoiner(" and ");
                    if (username.isEmpty()) {

View on GitHub (pinned to e1c734241f)

Solutions

Set both quarkus.proxy."<name>".username and quarkus.proxy."<name>".password in application.properties (or profile-specific config).
If you did not intend credentials, remove the single username or password property so both are unset.
If credentials come from env vars/secrets, verify the variables are defined in the build-time environment too (proxy config is read at build time by the recorder).
Check for typos in the property keys and confirm you edited the correct Quarkus profile section (%prod, %dev).

Example fix

// before (application.properties)
quarkus.proxy."corp".host=proxy.corp.example
quarkus.proxy."corp".port=8080
quarkus.proxy."corp".username=svc-user

// after
quarkus.proxy."corp".host=proxy.corp.example
quarkus.proxy."corp".port=8080
quarkus.proxy."corp".username=svc-user
quarkus.proxy."corp".password=${PROXY_PASSWORD}

Defensive patterns

Strategy: validation

Validate before calling

// Fail fast in a test or startup check before the build/config validation
Optional<String> user = configValueFactory("quarkus.proxy.\"corp\".username");
Optional<String> pass = configValueFactory("quarkus.proxy.\"corp\".password");
if (user.isPresent() != pass.isPresent()) {
    throw new IllegalArgumentException(
        "quarkus.proxy.\"corp\".username and .password must be both set or both unset");
}

Prevention

Keep username and password adjacent in application.properties so one is never forgotten.
Source credentials from a single mechanism (env var or credentials provider), not a mix.
Add an application.properties lint/test that asserts paired properties are both present or both absent.
Remember proxy config is build-time: verify secrets exist in the CI/build environment, not only at runtime.

When it happens

Trigger: A static init/recorder run at build time where, for a given named proxy prefix, config.username().isPresent() != config.password().isPresent() — i.e. quarkus.proxy."my-proxy".username is set but quarkus.proxy."my-proxy".password is not (or vice versa).

Common situations: Setting the username in application.properties and the password via an environment variable or secret that is missing at build time; typos like quarkus.proxy."p".pasword; partially migrating proxy config; a CI environment where only one secret was injected.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/5a9550745f1cbf28. Report an issue: GitHub.