quarkusio/quarkus · warning · BadRequestException

Unsupported parameter:

Error message

Unsupported parameter:

What it means

AcceptHeaders.getStringQualityValues() parses headers like Accept-Language and Accept-Charset into quality values. Each comma-separated item may carry parameters of the form name=value; only q (quality) is permitted. Any other parameter name triggers this BadRequestException.

Source

Thrown at independent-projects/resteasy-reactive/server/runtime/src/main/java/org/jboss/resteasy/reactive/server/core/request/AcceptHeaders.java:56

            if (endIndex < 0) {
                content = header.substring(offset);
            } else {
                content = header.substring(offset, endIndex);
            }

            QualityValue qualityValue = QualityValue.DEFAULT;
            int qualityIndex = content.indexOf(';');
            if (qualityIndex >= 0) {
                String parameter = content.substring(qualityIndex + 1);
                content = content.substring(0, qualityIndex);

                int equalsIndex = parameter.indexOf('=');
                if (equalsIndex < 0) {
                    throw new BadRequestException("Malformed parameter: " + parameter);
                }
                String name = parameter.substring(0, equalsIndex).trim();
                if (!"q".equals(name)) {
                    throw new BadRequestException("Unsupported parameter: " + parameter);
                }
                String value = parameter.substring(equalsIndex + 1).trim();
                qualityValue = QualityValue.valueOf(value);
            }

            content = content.trim();
            if (content.length() == 0) {
                throw new BadRequestException("Empty Field in header: " + header);
            }
            if (content.equals("*")) {
                result.put(null, qualityValue);
            } else {
                result.put(content, qualityValue);
            }

            if (endIndex < 0) {
                break;
            }

View on GitHub (pinned to e1c734241f)

Solutions

  1. Remove or rename the unsupported parameter so only q=... remains in the header value
  2. Fix the client/proxy that generates the header to emit RFC-compliant values
  3. Sanitize/rewrite the header in a filter or proxy before it reaches the server

Example fix

// before
Accept-Language: en;level=1
// after
Accept-Language: en;q=0.9
Defensive patterns

Strategy: validation

Validate before calling

boolean hasOnlyQParams(String item) {
    for (String p : item.split(";")) {
        String t = p.trim();
        if (t.isEmpty()) continue;
        int eq = t.indexOf('=');
        if (eq > 0 && !t.substring(0, eq).trim().equals("q")) return false;
    }
    return true;
}

Type guard

boolean isAcceptHeaderItemSafe(String header) {
    return header != null && java.util.Arrays.stream(header.split(","))
        .allMatch(this::hasOnlyQParams);
}

Try / catch

try {
    AcceptHeaders.getStringQualityValues(header);
} catch (BadRequestException e) {
    log.warn("Rejecting malformed header: " + e.getMessage());
    // fall back to default negotiation
}

Prevention

When it happens

Trigger: A client sends a header like 'Accept-Language: en;level=1' or 'Accept-Charset: utf-8;x=y' — a parameter whose name is not 'q'.

Common situations: Custom HTTP clients or proxies appending non-standard parameters; hand-written header values in tests; browser plugins or corporate middleware injecting parameters like 'level' or 'charset'.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/91a7665c610081f4. Report an issue: GitHub.