{"record":{"id":"0ae666918cc5f89e","repo":"quarkusio/quarkus","slug":"annotations-annotations-can-only-be-used-when","errorCode":null,"errorMessage":"Annotations '<annotations>' can only be used when proactive authentication is disabled and either Quarkus REST, RESTEasy Classic or WebSockets Next extension is present","messagePattern":"Annotations '<annotations>' can only be used when proactive authentication is disabled and either Quarkus REST, RESTEasy Classic or WebSockets Next extension is present","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java","lineNumber":760,"sourceCode":"                }\n                throw new RuntimeException(\"\"\"\n                        Found method annotated with the @AuthorizationPolicy annotation that is not an endpoint: %s#%s\n                        \"\"\".formatted(method.declaringClass().name().toString(), method.name()));\n            }\n            return Stream.of(method);\n        }\n        return target.asClass().methods().stream()\n                .filter(HttpSecurityProcessor::hasProperEndpointModifiers)\n                .filter(mi -> !securityTransformer.hasSecurityAnnotation(mi));\n    }\n\n    private static void validateAuthMechanismAnnotationUsage(Capabilities capabilities,\n            VertxHttpBuildTimeConfig buildTimeConfig,\n            DotName[] annotationNames) {\n        if (buildTimeConfig.auth().proactive()\n                || (capabilities.isMissing(Capability.RESTEASY_REACTIVE) && capabilities.isMissing(Capability.RESTEASY)\n                        && capabilities.isMissing(Capability.WEBSOCKETS_NEXT))) {\n            throw new ConfigurationException(\"Annotations '\" + Arrays.toString(annotationNames) + \"' can only be used when\"\n                    + \" proactive authentication is disabled and either Quarkus REST, RESTEasy Classic or WebSockets Next\"\n                    + \" extension is present\");\n        }\n    }\n\n    private static boolean isMtlsClientAuthenticationEnabled(VertxHttpBuildTimeConfig httpBuildTimeConfig) {\n        return !ClientAuth.NONE.equals(httpBuildTimeConfig.tlsClientAuth());\n    }\n\n    public static Set<MethodInfo> collectClassMethodsWithoutRbacAnnotation(Collection<ClassInfo> classes,\n            SecurityTransformer securityTransformer) {\n        return classes\n                .stream()\n                .filter(c -> !securityTransformer.hasSecurityAnnotation(c))\n                .map(ClassInfo::methods)\n                .flatMap(Collection::stream)\n                .filter(HttpSecurityProcessor::hasProperEndpointModifiers)\n                .filter(m -> !securityTransformer.hasSecurityAnnotation(m))","sourceCodeStart":742,"sourceCodeEnd":778,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java#L742-L778","documentation":"Annotations like @Basic, @Form, @Mtls (auth mechanism annotations) are implemented via interceptors that only work when proactive authentication is disabled and a framework that supports per-endpoint mechanism selection (Quarkus REST, RESTEasy Classic, or WebSockets Next) is present. If either condition fails, the build fails with a ConfigurationException listing the offending annotations. This prevents silently ignored security annotations.","triggerScenarios":"Using HTTP auth mechanism annotations while quarkus.http.auth.proactive=true, or in an application lacking RESTEasy Reactive, RESTEasy Classic, and WebSockets Next extensions.","commonSituations":"Adding @Basic or @Form to a non-REST app (e.g. plain Vert.x or gRPC); upgrading an app where proactive auth was left enabled; forgetting to add a REST extension while using mechanism annotations.","solutions":["Set quarkus.http.auth.proactive=false in application.properties","Add one of: quarkus-rest (RESTEasy Reactive), quarkus-resteasy, or quarkus-websockets-next extension","Remove the mechanism annotations if per-endpoint auth mechanisms aren't needed"],"exampleFix":"// before (application.properties)\nquarkus.http.auth.proactive=true\n// after\nquarkus.http.auth.proactive=false","handlingStrategy":"validation","validationCode":"// application.properties check before build\n// quarkus.http.auth.proactive=false\n// and one of: quarkus-rest / quarkus-resteasy / quarkus-websockets-next dependency present","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Disable proactive auth whenever using per-endpoint mechanism annotations","Keep quarkus-rest (or resteasy-classic) in the project if you use @Basic/@Form annotations","Document that mechanism annotations require one of the supported extensions"],"tags":["quarkus","build-time","config","authentication"],"backgroundTag":"proactive-auth-enabled","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}