{"record":{"id":"d58980349fe2d15c","repo":"quarkusio/quarkus","slug":"this-method-must-not-be-invoked-d58980","errorCode":null,"errorMessage":"This method must not be invoked","messagePattern":"This method must not be invoked","errorType":"http","errorClass":"InternalServerErrorException","httpStatus":500,"severity":"error","filePath":"integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource3.java","lineNumber":17,"sourceCode":"package io.quarkus.it.keycloak;\n\nimport jakarta.ws.rs.GET;\nimport jakarta.ws.rs.InternalServerErrorException;\nimport jakarta.ws.rs.Path;\n\nimport io.quarkus.security.Authenticated;\n\n@Path(\"/web-app3\")\n@Authenticated\npublic class ProtectedResource3 {\n\n    @GET\n    public String getName() {\n        // CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie checks that if a state cookie is missing\n        // then 401 is returned when a redirect targets the endpoint requiring authentication\n        throw new InternalServerErrorException(\"This method must not be invoked\");\n    }\n}\n","sourceCodeStart":1,"sourceCodeEnd":20,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource3.java#L1-L20","documentation":"Deliberate sentinel in ProtectedResource3. This endpoint should never return successfully: the CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie scenario verifies that when a state cookie is missing during code-flow completion, Quarkus OIDC returns 401 instead of completing authentication. If the method body executes, authentication incorrectly succeeded without the state cookie.","triggerScenarios":"A redirect targets this endpoint and OIDC authentication completes even though the state cookie was absent — meaning the CSRF/state-cookie check was bypassed or misconfigured.","commonSituations":"Testing incomplete/failed code-flow callbacks; OIDC state cookie dropped by browser or cookie-domain misconfiguration; upgrading Quarkus and expecting the 401-on-missing-state-cookie behavior to hold.","solutions":["Verify the state cookie is being set on the initial redirect and sent back on the callback (check cookie domain/path/secure settings)","Confirm the OIDC extension version still enforces the state-cookie check (401 on missing cookie)","Fix the test/flow so the callback carries the state cookie before this endpoint can be reached"],"exampleFix":"// before\n@GET\npublic String getName() {\n    throw new InternalServerErrorException(\"This method must not be invoked\");\n}\n// after\n// Endpoint must stay unreachable; correct the flow so OIDC returns 401:\n// ensure the state cookie (q_auth) is present when the redirect returns\nto this resource; then this method is never executed.","handlingStrategy":"validation","validationCode":"if (oidcAuthenticationCompletionSucceeded() && stateCookieMissing()) {\n    throw new IllegalStateException(\"state cookie check bypassed: expected 401\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    given().get(\"/protected-resource-3\");\n} catch (InternalServerErrorException e) {\n    // authentication completed without a state cookie; check q_auth cookie handling\n}","preventionTips":["Never disable the OIDC state-cookie check","Test with cookies cleared to simulate missing state cookie","Pin/verify extension behavior after Quarkus upgrades"],"tags":["oidc","state-cookie","integration-test"],"backgroundTag":"missing-state-cookie","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}