{"record":{"id":"654bb956d3a6417c","repo":"quarkusio/quarkus","slug":"httpsecuritypolicy-that-applies-to-jaxrs-can-be-ef","errorCode":null,"errorMessage":"HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process\nhas completed, therefore this policy can not be used to select '%s' authentication mechanism","messagePattern":"HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process\nhas completed, therefore this policy can not be used to select '(.+?)' authentication mechanism","errorType":"exception","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java","lineNumber":82,"sourceCode":"                if (allPolicies.containsKey(policyName)) {\n                    annotationPoliciesOnly.put(policyName, allPolicies.get(policyName));\n                    continue;\n                }\n                var classAndMethodName = e.getKey().getClassName() + \"#\" + e.getKey().getMethodName();\n                throw new RuntimeException(\"\"\"\n                        Endpoint '%s' requires named HttpSecurityPolicy '%s' specified with '@AuthorizationPolicy',\n                        but no such policies has bean found. Please provide required policy as CDI bean.\n                        \"\"\".formatted(classAndMethodName, policyName));\n            }\n            policyNameToPolicy = Map.copyOf(annotationPoliciesOnly);\n        }\n        for (var httpPermission : HttpSecurityConfiguration.get().httpPermissions()) {\n            if (httpPermission.shouldApplyToJaxRs() && httpPermission.getAuthMechanisms() != null) {\n                // HTTP authentication mechanism is selected by HTTP authenticator that\n                // uses the AbstractPathMatchingHttpSecurityPolicy in the RoutingContext\n                // we cannot support this without bigger refactoring and the whole point of JAX-RS policy was to support\n                // the authentication annotations like @BasicAuthentication, so it doesn't make sense to support it\n                throw new ConfigurationException(\"\"\"\n                        HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process\n                        has completed, therefore this policy can not be used to select '%s' authentication mechanism\n                        \"\"\".formatted(httpPermission.getAuthMechanisms().names()));\n            }\n        }\n    }\n\n    /**\n     * @param securedMethodDesc method description\n     * @return true if method is secured with {@link io.quarkus.vertx.http.security.AuthorizationPolicy}\n     */\n    public boolean requiresAuthorizationPolicy(MethodDescription securedMethodDesc) {\n        return storage.requiresAuthorizationPolicy(securedMethodDesc);\n    }\n\n    /**\n     * @return true if there is no point running {@link #checkPermission(RoutingContext, Uni, MethodDescription)}\n     */","sourceCodeStart":64,"sourceCodeEnd":100,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java#L64-L100","documentation":"JAX-RS-matching HttpSecurityPolicies run after authentication, so they cannot be used to choose an authentication mechanism. If a quarkus.http.auth.permission entry both applies to JAX-RS (http.jaxrs=true or annotation-based) and sets auth.mechanism, startup fails with a ConfigurationException naming the mechanism(s).","triggerScenarios":"Configuring a permission like quarkus.http.auth.permission.p1.jaxrs=true together with quarkus.http.auth.permission.p1.auth.mechanism=basic (or form/other mechanisms).","commonSituations":"Developers wanting JAX-RS annotation-driven policies (e.g. @BasicAuthentication) while also assigning auth.mechanism in the same permission block, misunderstanding the evaluation order.","solutions":["Remove auth.mechanism from permissions that apply to JAX-RS.","Use mechanism selection only on non-JAX-RS permissions, or rely on annotations like @BasicAuthentication on the endpoint.","Split the permission into a JAX-RS policy permission and a separate path-based permission for mechanism selection."],"exampleFix":"// before\nquarkus.http.auth.permission.p1.jaxrs=true\nquarkus.http.auth.permission.p1.auth.mechanism=basic\n// after\nquarkus.http.auth.permission.p1.jaxrs=true\n// (no auth.mechanism; use @BasicAuthentication on the endpoint instead)","handlingStrategy":"validation","validationCode":"// in a startup test: fail if any jaxrs permission defines auth.mechanism\nfor (var perm : permissions) {\n  if (perm.jaxrs && perm.authMechanism != null) {\n    throw new IllegalStateException(\"auth.mechanism not allowed on jaxrs permission \" + perm.name);\n  }\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Never combine .jaxrs=true with .auth.mechanism in one permission","Use endpoint annotations (@BasicAuthentication) for JAX-RS auth selection","Review permission config against the Quarkus authorization guide"],"tags":["quarkus","http-security","jaxrs","configuration"],"backgroundTag":"invalid-permission-configuration","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}