{"record":{"id":"9194e1a3bad9bd59","repo":"quarkusio/quarkus","slug":"this-method-must-not-be-invoked-9194e1","errorCode":null,"errorMessage":"This method must not be invoked","messagePattern":"This method must not be invoked","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource2.java","lineNumber":30,"sourceCode":"\n@Path(\"/web-app2\")\n@Authenticated\npublic class ProtectedResource2 {\n\n    @Inject\n    @IdToken\n    JsonWebToken idToken;\n\n    @GET\n    @Path(\"name\")\n    public String getName() {\n        return \"web-app2:\" + idToken.getName();\n    }\n\n    @GET\n    @Path(\"callback-before-redirect\")\n    public String getNameCallbackBeforeRedirect() {\n        throw new InternalServerErrorException(\"This method must not be invoked\");\n    }\n}\n","sourceCodeStart":12,"sourceCodeEnd":33,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource2.java#L12-L33","documentation":"This is a deliberate sentinel thrown by an integration-test endpoint that must never be reached. ProtectedResource2's callback-before-redirect path exists only to assert that Quarkus OIDC redirects the user to the identity provider before any protected resource code executes; if this method runs, the OIDC code-flow redirect did not happen as expected.","triggerScenarios":"A request hits /web-app2/callback-before-redirect without first being redirected through the Keycloak OIDC authentication flow — i.e. the state cookie / code-flow handshake was skipped or the endpoint was authenticated when it should have forced a redirect.","commonSituations":"Running CodeFlowTest scenarios where authentication should redirect before reaching the resource; misconfigured quarkus-oidc properties (e.g. allow-anonymous or wrong auth paths) that let the request bypass the redirect; calling the endpoint directly with a tool like curl while carrying a valid session.","solutions":["Ensure the request goes through the OIDC code-flow redirect (no active session cookie) before this endpoint is called","Check quarkus-oidc tenant configuration so the path requires authentication and triggers a redirect","If testing intentionally, use an endpoint that does not throw, or remove the call"],"exampleFix":"// before\n@GET\n@Path(\"callback-before-redirect\")\npublic String getNameCallbackBeforeRedirect() {\n    throw new InternalServerErrorException(\"This method must not be invoked\");\n}\n// after\n// Reach this path only via the OIDC redirect flow; if it must be callable,\n// replace the throw with the real implementation:\n@GET\n@Path(\"callback-before-redirect\")\npublic String getNameCallbackBeforeRedirect() {\n    return \"web-app2:\" + idToken.getName();\n}","handlingStrategy":"validation","validationCode":"if (uri.getPath().contains(\"callback-before-redirect\") && securityIdentity.isAnonymous()) {\n    // expected: OIDC must redirect anonymous users before this endpoint runs\n    throw new IllegalStateException(\"expected OIDC redirect before reaching resource\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    String name = given().redirects().follow(false).when().get(\"/web-app2/callback-before-redirect\");\n} catch (InternalServerErrorException e) {\n    // code-flow redirect did not occur; inspect state cookie configuration\n}","preventionTips":["Always enter protected OIDC resources through the authentication redirect, never direct URLs","Verify state cookie is cleared before testing pre-redirect behavior","Assert 302 to the provider, not 500, in flow tests"],"tags":["oidc","integration-test","sentinel"],"backgroundTag":"unexpected-authenticated-request","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}