{"record":{"id":"03c33839e47b3341","repo":"quarkusio/quarkus","slug":"endpoint-classandmethodname-requires-named-ht","errorCode":null,"errorMessage":"Endpoint '${classAndMethodName}' requires named HttpSecurityPolicy '${policyName}' specified with '@AuthorizationPolicy',\nbut no such policies has bean found. Please provide required policy as CDI bean.","messagePattern":"Endpoint '(.+?)' requires named HttpSecurityPolicy '(.+?)' specified with '@AuthorizationPolicy',\nbut no such policies has bean found\\. Please provide required policy as CDI bean\\.","errorType":"exception","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java","lineNumber":69,"sourceCode":"                if (installedPolicy.name() != null) {\n                    var previousPolicy = allPolicies.put(installedPolicy.name(), installedPolicy);\n                    if (previousPolicy != null) {\n                        throw duplicateNamedPoliciesNotAllowedEx(previousPolicy, installedPolicy);\n                    }\n                }\n            }\n            var annotationPoliciesOnly = new HashMap<String, HttpSecurityPolicy>();\n            for (Map.Entry<MethodDescription, String> e : storage.getMethodToPolicyName().entrySet()) {\n                var policyName = e.getValue();\n                if (annotationPoliciesOnly.containsKey(policyName)) {\n                    continue;\n                }\n                if (allPolicies.containsKey(policyName)) {\n                    annotationPoliciesOnly.put(policyName, allPolicies.get(policyName));\n                    continue;\n                }\n                var classAndMethodName = e.getKey().getClassName() + \"#\" + e.getKey().getMethodName();\n                throw new RuntimeException(\"\"\"\n                        Endpoint '%s' requires named HttpSecurityPolicy '%s' specified with '@AuthorizationPolicy',\n                        but no such policies has bean found. Please provide required policy as CDI bean.\n                        \"\"\".formatted(classAndMethodName, policyName));\n            }\n            policyNameToPolicy = Map.copyOf(annotationPoliciesOnly);\n        }\n        for (var httpPermission : HttpSecurityConfiguration.get().httpPermissions()) {\n            if (httpPermission.shouldApplyToJaxRs() && httpPermission.getAuthMechanisms() != null) {\n                // HTTP authentication mechanism is selected by HTTP authenticator that\n                // uses the AbstractPathMatchingHttpSecurityPolicy in the RoutingContext\n                // we cannot support this without bigger refactoring and the whole point of JAX-RS policy was to support\n                // the authentication annotations like @BasicAuthentication, so it doesn't make sense to support it\n                throw new ConfigurationException(\"\"\"\n                        HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process\n                        has completed, therefore this policy can not be used to select '%s' authentication mechanism\n                        \"\"\".formatted(httpPermission.getAuthMechanisms().names()));\n            }\n        }","sourceCodeStart":51,"sourceCodeEnd":87,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java#L51-L87","documentation":"An endpoint annotated with @AuthorizationPolicy referencing a named HttpSecurityPolicy requires a CDI bean exposing that policy name. JaxRsPathMatchingHttpSecurityPolicy builds the name→policy map at startup; if an annotation references a name with no matching bean, it throws a RuntimeException naming the endpoint class#method.","triggerScenarios":"@AuthorizationPolicy(name=\"my-policy\") on a REST resource where no HttpSecurityPolicy bean named 'my-policy' is registered (missing bean, wrong name, bean not discovered).","commonSituations":"Typo in the policy name, forgetting to annotate the policy bean with @Named or to make it a CDI bean, or the policy class not being in a bean-discovering package.","solutions":["Create/register a CDI bean implementing HttpSecurityPolicy with a @Named value exactly matching the annotation's name.","Fix any typo in the @AuthorizationPolicy name attribute.","Verify the policy bean is in an indexed/discovered package (add @ApplicationScoped or appropriate scope)."],"exampleFix":"// before\n@AuthorizationPolicy(name = \"custum-policy\")\n// after\n@AuthorizationPolicy(name = \"custom-policy\")\n// and ensure:\n@ApplicationScoped\n@Named(\"custom-policy\")\npublic class CustomPolicy implements HttpSecurityPolicy { ... }","handlingStrategy":"validation","validationCode":"// before startup, ensure bean exists for every @AuthorizationPolicy name\nSet<String> declared = scanAuthorizationPolicyNames(); // from annotations\nSet<String> provided = beanManager.getBeans(HttpSecurityPolicy.class)\n    .stream().map(b -> beanManager.qualifiers(b)) // collect @Named values\n    .collect(Collectors.toSet());\nif (!provided.containsAll(declared)) throw new IllegalStateException(\"missing policy beans: \" + declared);\n","typeGuard":null,"tryCatchPattern":"try {\n  startApplication();\n} catch (RuntimeException e) {\n  if (e.getMessage() != null && e.getMessage().contains(\"@AuthorizationPolicy\")) {\n    log.error(\"Register a CDI bean named '{}' implementing HttpSecurityPolicy\");\n  }\n}","preventionTips":["Keep a constant shared between the @Named bean and the @AuthorizationPolicy usage","Extract policy names into constants to avoid typos","Add an ArC/startup test covering all authorization policies"],"tags":["quarkus","http-security","cdi","authorization"],"backgroundTag":"missing-cdi-bean","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}