{"record":{"id":"8ed58c1ef48029c2","repo":"quarkusio/quarkus","slug":"this-method-must-not-be-invoked","errorCode":null,"errorMessage":"This method must not be invoked","messagePattern":"This method must not be invoked","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource.java","lineNumber":172,"sourceCode":"    @Path(\"tenant-split-tokens\")\n    public String getNameSplitTokens(@CookieParam(\"q_session_tenant-split-tokens\") String idToken,\n            @CookieParam(\"q_session_at_tenant-split-tokens\") String accessToken,\n            @CookieParam(\"q_session_rt_tenant-split-tokens\") String refreshToken) {\n        return String.format(\n                \"tenant-split-tokens:%s, id token has %d parts, access token has %d parts, refresh token has %d parts\",\n                getName(), idToken.split(\"\\\\.\").length, accessToken.split(\"\\\\.\").length, refreshToken.split(\"\\\\.\").length);\n    }\n\n    @GET\n    @Path(\"tenant-split-id-refresh-token\")\n    public String getNameIdRefreshSplitTokens() {\n        return \"tenant-split-id-refresh-token:\" + getName();\n    }\n\n    @GET\n    @Path(\"callback-before-wrong-redirect\")\n    public String getNameCallbackBeforeWrongRedirect() {\n        throw new InternalServerErrorException(\"This method must not be invoked\");\n    }\n\n    @GET\n    @Path(\"callback-before-redirect\")\n    public String getNameCallbackBeforeRedirect() {\n        throw new InternalServerErrorException(\"This method must not be invoked\");\n    }\n\n    @GET\n    @Path(\"callback-after-redirect\")\n    public String getNameCallbackAfterRedirect() {\n        return \"callback:\" + getName();\n    }\n\n    @GET\n    @Path(\"callback-jwt-before-redirect\")\n    public String getNameCallbackJwtBeforeRedirect() {\n        throw new InternalServerErrorException(\"This method must not be invoked\");","sourceCodeStart":154,"sourceCodeEnd":190,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource.java#L154-L190","documentation":"This endpoint is a negative-control in the oidc-code-flow integration test: it must never be reached because the OIDC filter is expected to redirect the unauthenticated request to Keycloak before the request reaches the resource. Hitting it means the expected authentication redirect did not happen, so the resource throws InternalServerErrorException to fail the test loudly.","triggerScenarios":"An HTTP GET to /protected/callback-before-wrong-redirect actually reaches the JAX-RS method, meaning the OIDC code-flow authentication mechanism failed to redirect the caller to the OIDC provider before resource dispatch.","commonSituations":"The OIDC redirect path/tenant configuration is wrong so the request is dispatched to the resource instead of Keycloak; a test change removed the required authentication on this path; quarkus.oidc.code-flow or redirect-params settings changed so the wrong-redirect scenario no longer triggers a redirect.","solutions":["Check quarkus.oidc.* configuration (auth paths, redirect URI, tenant settings) so this path is actually protected and triggers a code-flow redirect","Confirm the OIDC extension's authentication mechanism is enabled and Keycloak is reachable so the redirect is issued","Update the integration test expectations if the intended redirect behavior changed","If seen in production code, replace this sentinel pattern with proper deny/redirect logic — it exists only as a test tripwire"],"exampleFix":null,"handlingStrategy":"validation","validationCode":null,"typeGuard":null,"tryCatchPattern":"try { return resource.call(); } catch (javax.ws.rs.InternalServerErrorException e) { assertRedirectHappened(); }","preventionTips":["Keep the path covered by an authenticated quarkus.http.auth.permission scope","Never remove authentication from sentinel test paths","Assert 302 + Location header to Keycloak before following redirects in tests","Re-check tenant paths config after Quarkus upgrades"],"tags":["oidc","redirect","test-assertion","quarkus"],"backgroundTag":"unexpected-authenticated-request","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}