{"record":{"id":"5361a3cc44292b81","repo":"quarkusio/quarkus","slug":"cdi-container-is-not-available-cannot-initialize","errorCode":null,"errorMessage":"CDI container is not available, cannot initialize HTTP Security configuration","messagePattern":"CDI container is not available, cannot initialize HTTP Security configuration","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityConfiguration.java","lineNumber":490,"sourceCode":"     * authentication are loaded. It is unnecessary to use this method inside this HTTP Security package.\n     *\n     * @return true if programmatic configuration is ready\n     */\n    public static boolean isNotReady(VertxHttpConfig httpConfig, VertxHttpBuildTimeConfig httpBuildTimeConfig,\n            LaunchMode launchMode) {\n        if (instance != null) {\n            return false;\n        }\n\n        var container = Arc.container();\n        if (container == null) {\n            if (launchMode == LaunchMode.DEVELOPMENT) {\n                // there is one exception when we know that CDI container can be null and that is when server is starting\n                // after failed start (e.g. compilation error was fixed); we document this known limitation and it is\n                // only relevant for TLS config and TLS client auth, we must fail for everything else\n                return true;\n            } else {\n                throw new IllegalStateException(\n                        \"CDI container is not available, cannot initialize HTTP Security configuration\");\n            }\n        } else if (isHttpSecurityEventNotObserved(container)) {\n            return false;\n        }\n\n        get(httpConfig, httpBuildTimeConfig);\n        return false;\n    }\n\n    public static CSRF getProgrammaticCsrfConfig(VertxHttpConfig httpConfig, VertxHttpBuildTimeConfig httpBuildTimeConfig) {\n        var container = Arc.container();\n        if (container == null || isHttpSecurityEventNotObserved(container)) {\n            // return null for example if the security extension is not present, or if user doesn't use the HttpSecurity\n            return null;\n        }\n        return get(httpConfig, httpBuildTimeConfig).csrf;\n    }","sourceCodeStart":472,"sourceCodeEnd":508,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityConfiguration.java#L472-L508","documentation":"HTTP Security configuration initialization needs the CDI container to look up observers/beans, but the container reference was null. In DEVELOPMENT mode this is tolerated during restart-after-failed-build (returns isNotReady=true), but in other modes it fails fast with IllegalStateException because security configuration (TLS, client auth, events) cannot be safely initialized.","triggerScenarios":"HttpSecurityConfiguration.isNotReady() runs during HTTP server start with container == null outside DEVELOPMENT mode — e.g. prod/test startup ordering where the HTTP security policy initializes before ArC finished, or a failed launch path re-initializing config.","commonSituations":"Prod-mode builds with the HTTP security policy active but CDI not yet available at HTTP init; custom extensions starting the HTTP layer too early; corrupted/restarted dev-mode state where the documented limitation for TLS config is exceeded.","solutions":["Ensure the application boots normally in the target mode; verify no build/startup step forces HTTP security init before the CDI container exists.","If triggered in dev mode after a failed restart, fix the underlying compilation/startup error and let dev mode restart cleanly.","Check extensions that start the HTTP server; update/align them so they run after CDI init (Arc.container() != null).","Reproduce with -Dquarkus.log.category.\"io.quarkus.vertx.http\".level=DEBUG to see which config path hit the null container.","Report/inspect if it only occurs in tests with custom QuarkusApplication or manual HTTP recorder invocation."],"exampleFix":"// before: security policy initialized eagerly before CDI is ready in prod\n// after: guard startup order or run init on an event that fires after CDI is available\nif (Arc.container() == null) {\n    throw new IllegalStateException(\"HTTP Security init must run after CDI container start\");\n}","handlingStrategy":"validation","validationCode":"if (io.quarkus.arc.Arc.container() == null && LaunchMode.current() != LaunchMode.DEVELOPMENT) {\n    throw new IllegalStateException(\"Cannot init HTTP security before CDI container is available\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    securityInit();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"CDI container is not available\")) {\n        // defer init until after container start / observe StartedEvent\n    } else throw e;\n}","preventionTips":["Initialize security from an CDI observer of container startup events","Keep dev-mode compile errors fixed promptly to avoid half-restarts","Ensure custom extensions do not start HTTP before ArC"],"tags":["cdi","security","startup","quarkus","vertx-http"],"backgroundTag":"cdi-container-not-available","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}