The method ResponseCookieBuilder.from is marked as String value, but ResponseBuilder.value(@Nullable String value) and public DefaultResponseCookieBuilder(String name, @Nullable String value, boolean lenient) and are both marked with @Nullable. Additionally, ResponseCookie and its superclass HttpCookie allow for a null value (it is turned into an empty String).