{"record":{"id":"f6753fd082c25f68","repo":"quarkusio/quarkus","slug":"security-annotation-placed-on-resource-method-c","errorCode":null,"errorMessage":"Security annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.","messagePattern":"Security annotation placed on resource method '(.+?)#(.+?)' wasn't detected by Quarkus during the build time\\. Please consult https://quarkus\\.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java","lineNumber":272,"sourceCode":"        }\n\n        private SecurityCheckInfo getSecurityCheckInfo(ServerResourceMethod serverResourceMethod) {\n            if (securityCheckInfo == null) {\n                boolean isDefaultJaxRsSecCheck = false;\n                var desc = ResourceMethodDescription.of(serverResourceMethod);\n                var checkStorage = Arc.container().instance(SecurityCheckStorage.class).get();\n\n                var check = checkStorage.getSecurityCheck(desc.invokedMethodDesc());\n                if (check == null && desc.fallbackMethodDesc() != null) {\n                    check = checkStorage.getSecurityCheck(desc.fallbackMethodDesc());\n                }\n                if (check == null) {\n                    check = checkStorage.getDefaultSecurityCheck();\n                    isDefaultJaxRsSecCheck = true;\n                }\n\n                if (check == null) {\n                    throw new IllegalStateException(\n                            \"\"\"\n                                    Security annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.\n                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.\n                                    \"\"\"\n                                    .formatted(desc.invokedMethodDesc().getClassName(),\n                                            desc.invokedMethodDesc().getMethodName()));\n                }\n\n                securityCheckInfo = new SecurityCheckInfo(check, isDefaultJaxRsSecCheck, desc.invokedMethodDesc());\n            }\n\n            return securityCheckInfo;\n        }\n\n        private record SecurityCheckInfo(SecurityCheck check, boolean isDefaultJaxRsSecCheck,\n                MethodDescription invokedMethodDesc) {\n\n        }","sourceCodeStart":254,"sourceCodeEnd":290,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java#L254-L290","documentation":"getSecurityCheckInfo resolves the SecurityCheck for a resource method from the build-time populated check storage. If no check (standard security annotation mapping or the default configured check) is found for the method, the security annotation was not recorded during build, so it throws IllegalStateException pointing at the CDI bean discovery documentation.","triggerScenarios":"A resource method with a security annotation (@RolesAllowed, @PermitAll, @DenyAll) lives in a class that was not indexed/processed at build time (non-discoverable jar), or deny-unannotated configuration references a method whose class was never scanned, or stale build output after adding the annotation.","commonSituations":"Security annotations in external library jars without Jandex index; adding annotations without a clean rebuild; classes in modules not part of the Quarkus application index; dev-mode hot reload glitches.","solutions":["Index the containing module with Jandex or add META-INF/beans.xml so Quarkus can discover it","Clean rebuild the application (./mvnw clean install)","Move the resource class into an application module that Quarkus indexes","Confirm the annotation is a supported Quarkus security annotation and not shadowed by an import of a same-named annotation from another package"],"exampleFix":"// before: annotation from wrong package\nimport javax.annotation.security.RolesAllowed;\n// after\nimport jakarta.annotation.security.RolesAllowed;\n","handlingStrategy":"validation","validationCode":"// ensure the annotation is the supported one and the module is indexed\nClass<?> ra = Class.forName(\"jakarta.annotation.security.RolesAllowed\");\nif (!method.getAnnotation(ra).equals(usedAnnotation)) {\n    throw new IllegalStateException(\"Wrong RolesAllowed import — use jakarta.annotation.security\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    callSecuredEndpoint();\n} catch (IllegalStateException e) {\n    if (e.getMessage().contains(\"wasn't detected by Quarkus\")) {\n        // add Jandex index / beans.xml to the containing module and rebuild\n    } else throw e;\n}","preventionTips":["Use jakarta.annotation.security.* annotations, not javax or other look-alikes","Index dependency jars containing secured resources","Clean rebuild after adding security annotations; restart dev mode on hot-reload oddities"],"tags":["quarkus","security","cdi","bean-discovery","jandex"],"backgroundTag":"annotation-not-discovered-at-build-time","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}