{"record":{"id":"15d48e49d577e0ef","repo":"quarkusio/quarkus","slug":"registering-default-securitycheck-that-requires-se","errorCode":null,"errorMessage":"Registering default SecurityCheck that requires secured method arguments is not supported","messagePattern":"Registering default SecurityCheck that requires secured method arguments is not supported","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java","lineNumber":243,"sourceCode":"\n        private volatile SecurityCheckInfo securityCheckInfo;\n\n        @Override\n        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,\n                ServerResourceMethod serverResourceMethod) {\n            if (phase == Phase.AFTER_MATCH) {\n                final SecurityCheckInfo info = getSecurityCheckInfo(serverResourceMethod);\n                return List.of(new EagerSecurityHandler(info.check, info.isDefaultJaxRsSecCheck, info.invokedMethodDesc));\n            }\n\n            if (phase == Phase.BEFORE_METHOD_INVOKE && requiresMethodArguments(serverResourceMethod)) {\n                final SecurityCheckInfo info = getSecurityCheckInfo(serverResourceMethod);\n                if (info.isDefaultJaxRsSecCheck) {\n                    // with current implementation, this IF will never be true as the default checks are about\n                    // default @RolesAllowed or @Deny configurable in application.properties for unannotated methods;\n                    // it is difficult to imagine check that requires method arguments and is applied for all methods;\n                    // if this was ever implemented, respective server handler needs to be updated accordingly\n                    throw new IllegalStateException(\n                            \"Registering default SecurityCheck that requires secured method arguments is not supported\");\n                }\n                return List.of(new SecurityCheckWithMethodArgsHandler(info.check, info.invokedMethodDesc));\n            }\n\n            return List.of();\n        }\n\n        private boolean requiresMethodArguments(ServerResourceMethod serverResourceMethod) {\n            return getSecurityCheckInfo(serverResourceMethod).check.requiresMethodArguments();\n        }\n\n        private SecurityCheckInfo getSecurityCheckInfo(ServerResourceMethod serverResourceMethod) {\n            if (securityCheckInfo == null) {\n                boolean isDefaultJaxRsSecCheck = false;\n                var desc = ResourceMethodDescription.of(serverResourceMethod);\n                var checkStorage = Arc.container().instance(SecurityCheckStorage.class).get();\n","sourceCodeStart":225,"sourceCodeEnd":261,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java#L225-L261","documentation":"EagerSecurityHandler builds a per-method security handler chain. If the resolved SecurityCheckInfo is the default JAX-RS check AND requires secured method arguments, the current architecture has no handler able to pass method arguments for the default check, so it fails fast. The code notes this should be unreachable today — it is a defensive guard.","triggerScenarios":"A custom SecurityCheck registered as the default check declares that it requires method arguments (e.g. via @MethodPermission or check signature needing method params) while being installed as the default (unannotated-method) check.","commonSituations":"Writing a custom security check extension that registers a default check via build steps while its implementation demands method arguments; future/refactored Quarkus security check implementations.","solutions":["Implement the check as an explicit annotation-based SecurityCheck (applied per-method), not the default check","Ensure the default security check does not require method arguments (drop the arguments requirement)","Use a server request filter or custom handler to implement argument-dependent authorization instead","Upgrade Quarkus — if this surfaces from framework code, it indicates a framework bug; report it"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":"// when registering a default SecurityCheck, assert it doesn't require method args\nif (defaultCheck.requiresMethodArguments()) {\n    throw new IllegalArgumentException(\"Default SecurityCheck must not require method arguments\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    handlers();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"requires secured method arguments\")) {\n        // replace the default check with an annotation-based check\n    } else throw e;\n}","preventionTips":["Design default checks (deny-unannotated) without method-argument requirements","Use per-method annotation checks when authorization needs method parameters","Prefer server request filters for argument-dependent authorization"],"tags":["quarkus","security","resteasy-reactive","unsupported"],"backgroundTag":"unsupported-default-security-check","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}