quarkusio/quarkus · error · IllegalArgumentException

{what} must not be null

Error message

{what} must not be null

What it means

RestCsrfBuilder.requireNonNull validates mandatory build inputs (form field name, header/cookie names, cookie max-age/path/domain, etc.). A null among these makes the builder throw IllegalArgumentException immediately. This typically means a required config property resolved to null or a null was passed programmatically to the builder.

Source

Thrown at extensions/resteasy-reactive/rest-csrf/runtime/src/main/java/io/quarkus/csrf/reactive/runtime/RestCsrfBuilder.java:150

        return this;
    }

    @Override
    public CSRF build() {
        record CSRFImpl(String formFieldName, String tokenHeaderName, String cookieName, Duration cookieMaxAge,
                String cookiePath, Optional<String> cookieDomain, boolean cookieForceSecure,
                boolean cookieHttpOnly, Optional<Set<String>> createTokenPath, int tokenSize,
                Optional<String> tokenSignatureKey, boolean verifyToken,
                boolean requireFormUrlEncoded) implements RestCsrfConfig, CSRF {
        }
        return new CSRFImpl(formFieldName, tokenHeaderName, cookieName, cookieMaxAge, cookiePath, cookieDomain,
                cookieForceSecure, cookieHttpOnly, createTokenPath, tokenSize, tokenSignatureKey, verifyToken,
                requireFormUrlEncoded);
    }

    private static <T> T requireNonNull(T value, String what) {
        if (value == null) {
            throw new IllegalArgumentException(what + " must not be null");
        }
        return value;
    }

    private static RestCsrfConfig getRestCsrfConfig() {
        return ConfigProvider.getConfig().unwrap(SmallRyeConfig.class).getConfigMapping(RestCsrfConfig.class);
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Set all quarkus.rest-csrf.* required properties (form-field-name, cookie-name, cookie-path, etc.) to non-null values in application.properties
2. In programmatic builder usage, pass explicit defaults (e.g. "csrf-token", "Benign", "/") instead of null
3. Check profile-specific configs (e.g. %test.) that may null out a property
4. Inspect the message prefix ({what}) to identify which exact attribute is null

Example fix

// before
quarkus.rest-csrf.cookie-path=
// after
quarkus.rest-csrf.cookie-path=/

Objects.requireNonNull(cfg.formFieldName(), "quarkus.rest-csrf.form-field-name must not be null"); Objects.requireNonNull(cfg.cookieName(), "quarkus.rest-csrf.cookie-name must not be null"); Objects.requireNonNull(cfg.cookiePath(), "quarkus.rest-csrf.cookie-path must not be null");

try { RestCsrfConfig cfg = buildRestCsrf(); } catch (IllegalArgumentException e) { LOG.error("Missing required quarkus.rest-csrf config: " + e.getMessage()); throw e; }

When it happens

Trigger: Programmatic use of RestCsrfBuilder (e.g. in tests or custom setup) passing null for formFieldName/tokenHeaderName/cookieName/cookieMaxAge/cookiePath/cookieDomain; or RestCsrfConfig mapping producing null for a required attribute.

Common situations: Overriding quarkus.rest-csrf.* config with null values via profiles/test resources; calling builder methods directly with null; custom config mapping missing defaults.

Related errors

• The class (${name}) cannot be created during deployment.
• Can not add converter ${converter.name()} that is not parame
• Converter ${converter.name()} must be parameterized with a s
• The supplied 'main-class' value of '${mainClassName}' does n
• Unknown class: ${token}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/cf81d0cf02cd2e06. Report an issue: GitHub.