{"record":{"id":"e8d5d5db4de02685","repo":"quarkusio/quarkus","slug":"websocket-endpoint-s-requires-secured-http-upgr","errorCode":null,"errorMessage":"WebSocket endpoint '%s' requires secured HTTP upgrade but Quarkus did not configure security check correctly. Please open issue in Quarkus project","messagePattern":"WebSocket endpoint '(.+?)' requires secured HTTP upgrade but Quarkus did not configure security check correctly\\. Please open issue in Quarkus project","errorType":"validation","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/websockets-next/deployment/src/main/java/io/quarkus/websockets/next/deployment/WebSocketProcessor.java","lineNumber":953,"sourceCode":"    }\n\n    private static boolean isTracesSupportEnabled(Capabilities capabilities) {\n        return capabilities.isPresent(Capability.OPENTELEMETRY_TRACER);\n    }\n\n    private static boolean isMetricsSupportEnabled(Optional<MetricsCapabilityBuildItem> metricsCapability) {\n        return metricsCapability.map(m -> m.metricsSupported(MetricsFactory.MICROMETER)).orElse(false);\n    }\n\n    private static Map<String, SecurityCheck> collectEndpointSecurityChecks(List<WebSocketEndpointBuildItem> endpoints,\n            ClassSecurityCheckStorageBuildItem storage, IndexView index, SecurityTransformer securityTransformer) {\n        Map<String, SecurityCheck> endpointSecurityChecks = endpoints\n                .stream().<Map.Entry<String, SecurityCheck>> mapMulti((endpoint, consumer) -> {\n                    var beanName = endpoint.beanClassName();\n                    if (storage.getSecurityCheck(beanName) instanceof SecurityCheck check) {\n                        consumer.accept(Map.entry(endpoint.id, check));\n                    } else if (securityTransformer.hasSecurityAnnotation(index.getClassByName(beanName))) {\n                        throw new IllegalStateException(\"WebSocket endpoint '%s' requires \".formatted(beanName)\n                                + \"secured HTTP upgrade but Quarkus did not configure security check \"\n                                + \"correctly. Please open issue in Quarkus project\");\n                    }\n                })\n                // Do not use Collectors.toUnmodifiableMap() here - its iteration order is not stable.\n                // Instead, collect to a regular HashMap<K, V> and wrap it in Collections.unmodifiableMap()\n                // down below.\n                .collect(Collectors.toMap(Map.Entry::getKey, Map.Entry::getValue, (previous, current) -> {\n                    throw new IllegalStateException(\"Multiple WebSocket endpoints with the same id\");\n                }));\n        return Collections.unmodifiableMap(endpointSecurityChecks);\n    }\n\n    private static Map<String, Set<String>> collectEndpointAuthorizationPolicies(SecurityTransformer securityTransformer,\n            List<WebSocketEndpointBuildItem> endpoints, IndexView index) {\n        long authorizationPoliciesCount = securityTransformer.getSecurityAnnotationNames(AUTHORIZATION_POLICY)\n                .stream().mapToLong(n -> securityTransformer.getAnnotations(n).size()).sum();\n        if (authorizationPoliciesCount == 0) {","sourceCodeStart":935,"sourceCodeEnd":971,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/websockets-next/deployment/src/main/java/io/quarkus/websockets/next/deployment/WebSocketProcessor.java#L935-L971","documentation":"WebSocket endpoints annotated with HTTP security annotations require a registered SecurityCheck so the HTTP upgrade request is authenticated/authorized. The processor found a security annotation on the endpoint class but no corresponding SecurityCheck in the storage, meaning the security extension did not wire the check. Per the message, this is treated as a Quarkus bug rather than user error.","triggerScenarios":"An endpoint class carries a security annotation (detected by securityTransformer.hasSecurityAnnotation) while storage.getSecurityCheck(beanClassName) returns null during the build of a websockets-next application.","commonSituations":"Using @Authenticated or similar annotations without the quarkus-security/HTTP security extension on the classpath; annotation processed by a different (older) security integration; version drift between quarkus-websockets-next and quarkus-security after an upgrade.","solutions":["Add/configure the Quarkus security extension (e.g. quarkus-security, quarkus-oidc, quarkus-smallrye-jwt) so security checks are registered.","Verify quarkus-websockets-next and quarkus-security come from the same Quarkus BOM version.","Report to the Quarkus project with a reproducer if versions align and the error persists.","As a workaround, secure the HTTP upgrade path explicitly (e.g. an HTTP security policy on the endpoint path) instead of annotation-driven security."],"exampleFix":"// before\n<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-websockets-next</artifactId></dependency>\n// after: add security so SecurityCheck gets registered\n<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-websockets-next</artifactId></dependency>\n<dependency><groupId>io.quarkus</groupId><artifactId>quarkus-oidc</artifactId></dependency>","handlingStrategy":"validation","validationCode":"// Ensure the security extension is present whenever endpoint classes carry security annotations:\nboolean hasSecurityAnnotations = endpointSources.stream()\n    .anyMatch(src -> src.contains(\"@Authenticated\") || src.contains(\"@AuthorizationPolicy\"));\nboolean hasSecurityExtension = pomIncludes(\"quarkus-security\") || pomIncludes(\"quarkus-oidc\");\nif (hasSecurityAnnotations && !hasSecurityExtension) throw new IllegalStateException(\"Add a Quarkus security extension\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Always add a security extension when using security annotations on endpoints","Keep quarkus-websockets-next and quarkus-security on the same BOM version","Verify the annotation is one processed by the installed security integration","Test endpoint builds in CI so missing wiring fails fast"],"tags":["quarkus","websockets-next","security","build-time","annotations"],"backgroundTag":"websocket-security-check-not-registered","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}