{"record":{"id":"dbe310ca84a33afd","repo":"quarkusio/quarkus","slug":"security-annotation-placed-on-resource-method-c-dbe310","errorCode":null,"errorMessage":"Security annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.","messagePattern":"Security annotation placed on resource method '(.+?)#(.+?)' wasn't detected by Quarkus during the build time\\. Please consult https://quarkus\\.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityInterceptorHandler.java","lineNumber":56,"sourceCode":"\n        public static HandlerChainCustomizer newInstance() {\n            return new Customizer();\n        }\n\n        @Override\n        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,\n                ServerResourceMethod serverResourceMethod) {\n            if (phase == Phase.AFTER_MATCH) {\n\n                var desc = ResourceMethodDescription.of(serverResourceMethod);\n                var interceptorStorage = Arc.container().instance(EagerSecurityInterceptorStorage.class).get();\n                var interceptor = interceptorStorage.getInterceptor(desc.invokedMethodDesc());\n                if (interceptor == null && desc.fallbackMethodDesc() != null) {\n                    interceptor = interceptorStorage.getInterceptor(desc.fallbackMethodDesc());\n                }\n\n                if (interceptor == null) {\n                    throw new IllegalStateException(\n                            \"\"\"\n                                    Security annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.\n                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.\n                                    \"\"\"\n                                    .formatted(desc.invokedMethodDesc().getClassName(),\n                                            desc.invokedMethodDesc().getMethodName()));\n                }\n\n                return Collections.singletonList(new EagerSecurityInterceptorHandler(interceptor));\n            }\n            return Collections.emptyList();\n        }\n\n    }\n}\n","sourceCodeStart":38,"sourceCodeEnd":72,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityInterceptorHandler.java#L38-L72","documentation":"EagerSecurityInterceptorHandler looks up the build-time registered security interceptor for the invoked (or fallback) resource method. If none is found, the security annotation on that method was never processed at build time, and startup/request handling fails with IllegalStateException pointing to the bean discovery guide.","triggerScenarios":"A resource method carrying a security annotation is served by Quarkus REST but its class was not part of the build-time index (unindexed dependency jar), the interceptor storage was built before the annotation existed, or fallback/invoked method descriptions don't match any registered interceptor.","commonSituations":"Resources in separate library modules without Jandex indexing; annotation added but application not rebuilt; mismatched Quarkus versions where the interceptor registration build step did not run.","solutions":["Add a Jandex index (jandex-maven-plugin) or beans.xml to the module containing the resource","Clean rebuild the application so interceptor storage includes the method","Move the resource into an indexed application module","Align Quarkus extension versions with the platform BOM and restart dev mode"],"exampleFix":"// library pom: index it\n<plugin>\n  <groupId>io.smallrye</groupId>\n  <artifactId>jandex-maven-plugin</artifactId>\n  <executions><execution><goals><goal>jandex</goal></goals></execution></executions>\n</plugin>\n","handlingStrategy":"validation","validationCode":"// confirm the resource module is discoverable before deployment\nPath idx = Path.of(\"target/classes/META-INF/jandex.idx\");\nif (Files.notExists(idx) && Files.notExists(Path.of(\"src/main/resources/META-INF/beans.xml\"))) {\n    throw new IllegalStateException(\"Add Jandex index or beans.xml for security-annotated resources\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    callSecuredEndpoint();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"wasn't detected by Quarkus\")) {\n        // index the module and rebuild; verify interceptor registration build step ran\n    } else throw e;\n}","preventionTips":["Jandex-index every module that holds secured resources","Keep Quarkus versions aligned across extensions so interceptor build steps run","Restart dev mode after adding security annotations to hot-reloaded classes"],"tags":["quarkus","security","cdi","bean-discovery","resteasy-reactive"],"backgroundTag":"annotation-not-discovered-at-build-time","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T05:17:10.506Z"}