{"record":{"id":"faf5227ed08e0c98","repo":"quarkusio/quarkus","slug":"http-permission-path-contains-inner-wildcard-en","errorCode":null,"errorMessage":"HTTP permission path '' contains inner wildcard enclosed with a path character other than a separator. The inner wildcard must represent exactly one path segment. Please see this Quarkus guide for more information: https://quarkus.io/guides/security-authorize-web-endpoints-reference","messagePattern":"HTTP permission path '' contains inner wildcard enclosed with a path character other than a separator\\. The inner wildcard must represent exactly one path segment\\. Please see this Quarkus guide for more information: https://quarkus\\.io/guides/security-authorize-web-endpoints-reference","errorType":"validation","errorClass":"ConfigurationException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java","lineNumber":278,"sourceCode":"        private void addWildcardPath(String path, T handler, int wildcardIdx, String originalPath) {\n            final int lastIdx = path.length() - 1;\n            final String pathWithWildcard;\n            final String pathAfter1stWildcard;\n\n            if (lastIdx == wildcardIdx) {\n                // ends with a wildcard => it's a prefix path\n                pathWithWildcard = path;\n                pathAfter1stWildcard = null;\n            } else {\n                // contains at least one inner wildcard: /one/*/three, /one/two/*/four/*, ...\n                // the inner wildcard represents exactly one path segment\n                pathWithWildcard = path.substring(0, wildcardIdx + 1);\n                pathAfter1stWildcard = path.substring(wildcardIdx + 1);\n\n                // validate that inner wildcard is enclosed with path separators like: /one/*/two\n                // anything like: /one*/two, /one/*two/, /one/tw*o/ is not allowed\n                if (!pathWithWildcard.endsWith(\"/*\") || !pathAfter1stWildcard.startsWith(\"/\")) {\n                    throw new ConfigurationException(\"HTTP permission path '\" + originalPath + \"' contains inner \"\n                            + \"wildcard enclosed with a path character other than a separator. The inner wildcard \"\n                            + \"must represent exactly one path segment. Please see this Quarkus guide for more \"\n                            + \"information: https://quarkus.io/guides/security-authorize-web-endpoints-reference\");\n                }\n            }\n\n            final String pathWithoutWildcard;\n            if (pathWithWildcard.endsWith(\"/*\")) {\n                // remove /*\n                String stripped = pathWithWildcard.substring(0, pathWithWildcard.length() - 2);\n                pathWithoutWildcard = stripped.isEmpty() ? \"/\" : stripped;\n            } else {\n                // remove *\n                pathWithoutWildcard = pathWithWildcard.substring(0, pathWithWildcard.length() - 1);\n            }\n\n            Path<T> p = pathsWithWildcard.computeIfAbsent(pathWithoutWildcard, Path::new);\n            p.originalPath = originalPath;","sourceCodeStart":260,"sourceCodeEnd":296,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java#L260-L296","documentation":"In Quarkus HTTP authorization paths, a wildcard '*' is only allowed as a whole trailing or standalone segment. When a wildcard appears in the middle of a path, ImmutablePathMatcher requires it to be enclosed by path separators (e.g. /one/*/two); patterns like /one*/two or /one/*two are rejected with a ConfigurationException pointing to the Quarkus authorization guide.","triggerScenarios":"Adding a wildcard path via addPath/addWildcardPath where the character before '*' or the character right after it is not a path separator, e.g. quarkus.http.auth.permission.p1.paths=/api/v1* or /api*/v2.","commonSituations":"Users trying to express prefix matching like /api* instead of /api/*, or suffix matching like *.html in permission paths in application.properties.","solutions":["Rewrite the pattern so the wildcard is its own segment: use /api/* instead of /api*, or /api/*/v2 for middle wildcards.","If prefix matching is needed, list the exact paths or use a custom HttpSecurityPolicy.","Consult https://quarkus.io/guides/security-authorize-web-endpoints-reference for allowed wildcard syntax."],"exampleFix":"// before (application.properties)\nquarkus.http.auth.permission.admin.paths=/admin*\n// after\nquarkus.http.auth.permission.admin.paths=/admin/*","handlingStrategy":"validation","validationCode":"boolean validWildcardPath(String p) {\n  int i = p.indexOf('*');\n  if (i < 0) return p.startsWith(\"/\");\n  return p.startsWith(\"/\") && (i == p.length() - 1 || (p.charAt(i-1) == '/' && p.charAt(i+1) == '/'));\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Only use '*' as a full segment: /api/*/x or /api/*","Never use partial-segment wildcards like /api* or *.html","Run a config-validation test at startup"],"tags":["quarkus","http-security","configuration","wildcard"],"backgroundTag":"invalid-wildcard-path-pattern","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}