{"record":{"id":"930507edb0a6b4b0","repo":"quarkusio/quarkus","slug":"only-securityidentity-attached-to-a-websocket-serv","errorCode":null,"errorMessage":"Only SecurityIdentity attached to a WebSocket server connection can be updated","messagePattern":"Only SecurityIdentity attached to a WebSocket server connection can be updated","errorType":"exception","errorClass":"WebSocketServerException","httpStatus":null,"severity":"error","filePath":"extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java","lineNumber":319,"sourceCode":"                    }\n                }\n                if (updateNotSupported) {\n                    throw new WebSocketServerException(\"\"\"\n                            The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.\n                            Either add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or\n                            implement the provider yourself.\n                            \"\"\".formatted(WebSocketSecurity.class.getName(), IdentityProvider.class.getName(),\n                            WebSocketIdentityUpdateRequest.class.getName()));\n                }\n                final IdentityProviderManager identityProviderManager = ctx.getInjectedReference(IdentityProviderManager.class);\n                return new WebSocketSecurity() {\n                    @Override\n                    public CompletionStage<SecurityIdentity> updateSecurityIdentity(String accessToken) {\n                        if (connectionSupplier.get() instanceof WebSocketConnectionImpl connection) {\n                            SecuritySupport securitySupport = connection.securitySupport();\n                            return securitySupport.updateSecurityIdentity(accessToken, connection, identityProviderManager);\n                        }\n                        throw new WebSocketServerException(\n                                \"Only SecurityIdentity attached to a WebSocket server connection can be updated\");\n                    }\n                };\n            }\n        };\n    }\n}\n","sourceCodeStart":301,"sourceCodeEnd":327,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java#L301-L327","documentation":"WebSocketSecurity.updateSecurityIdentity(accessToken) resolves the current connection via the connection supplier and expects it to be a WebSocketConnectionImpl carrying a securitySupport. If the supplier returns null, a client connection, or anything else (i.e. there is no server connection bound to the current duplicated context), this WebSocketServerException is thrown.","triggerScenarios":"Calling updateSecurityIdentity from code that is not executing within a WebSocket server endpoint's duplicated context (background thread, non-endpoint request), or from a WebSocket client endpoint where the supplied object is not a server WebSocketConnectionImpl.","commonSituations":"Calling WebSocketSecurity from a scheduled job; using the security update API in a client endpoint by mistake; invoking the API after the server connection closed.","solutions":["Only call updateSecurityIdentity inside server WebSocket endpoint methods/callbacks running on the connection's duplicated context","Verify you are not in a WebSocket client endpoint (client connections are not supported)","Move identity update logic into the endpoint handler or an onMessage/onOpen callback","Check that the connection is still open when the update is performed"],"exampleFix":"// before\n@Scheduled(every = \"10s\")\nvoid refresh() { security.updateSecurityIdentity(token); } // no server connection context\n// after\n@OnMessage\nvoid onMessage(String msg) {\n    security.updateSecurityIdentity(token); // runs on server connection context\n}","handlingStrategy":"type-guard","validationCode":"if (Vertx.currentContext() == null) {\n    throw new IllegalStateException(\"updateSecurityIdentity must run on a WebSocket server connection context\");\n}","typeGuard":"static boolean canUpdateIdentity(WebSocketSecurity security) {\n    io.vertx.core.Context ctx = Vertx.currentContext();\n    return ctx != null && io.quarkus.websockets.next.runtime.VertxContext.isDuplicatedContext(ctx);\n}","tryCatchPattern":"try {\n    security.updateSecurityIdentity(token);\n} catch (WebSocketServerException e) {\n    log.error(\"Call updateSecurityIdentity only from a server endpoint callback\", e);\n}","preventionTips":["Only call WebSocketSecurity.updateSecurityIdentity inside server endpoint methods","Never call it from @Scheduled jobs, filters, or client endpoints","Ensure the connection is still open when updating identity"],"tags":["websockets","security","identity","context-local","server"],"backgroundTag":"security-identity-update-outside-connection","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}