quarkusio/quarkus · error · IllegalStateException

Authorization Policy has not been set for paths:

Error message

Authorization Policy has not been set for paths: 

What it means

Thrown by HttpPermissionImpl.getPolicy() when getPolicy() is queried but no authorization policy was ever set on the permission (authorizationPolicy or its inner policy is null). This IllegalStateException indicates the permission was registered without a terminal policy call, so it cannot produce an HttpSecurityPolicy.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java:542

        @Override
        public boolean shouldApplyToJaxRs() {
            return applyToJaxRs;
        }

        @Override
        public Set<String> getMethods() {
            return methods == null ? Set.of() : Set.of(methods);
        }

        @Override
        public HttpSecurityConfiguration.AuthenticationMechanisms getAuthMechanisms() {
            return authMechanism;
        }

        @Override
        public Policy getPolicy() {
            if (authorizationPolicy == null || authorizationPolicy.policy == null) {
                throw new IllegalStateException("Authorization Policy has not been set for paths: " + getPaths());
            }
            return authorizationPolicy.policy;
        }
    }

    private static final class PermissionsHttpSecurityPolicy implements HttpSecurityPolicy {

        private final Permission[] permissions;

        private PermissionsHttpSecurityPolicy(Permission[] permissions) {
            this.permissions = Arrays.copyOf(permissions, permissions.length);
        }

        @Override
        public Uni<CheckResult> checkPermission(RoutingContext request, Uni<SecurityIdentity> identityUni,
                AuthorizationRequestContext requestContext) {
            return identityUni.onItemOrFailure()
                    .transformToUni(new BiFunction<SecurityIdentity, Throwable, Uni<? extends CheckResult>>() {

View on GitHub (pinned to e1c734241f)

Solutions

1. Terminate every permission chain with exactly one policy call: permit(), deny(), roles(...), permissions(...), policy(...), or authenticated().
2. Audit all paths(...) chains in your HttpSecurity setup for missing terminal calls.
3. If consuming getPolicy() yourself, check the permission's policy state before calling.

Example fix

// before
var perm = httpSecurity.paths("/api/*").methods("GET"); // no policy
// after
httpSecurity.paths("/api/*").methods("GET").permit();

// before finishing setup, assert each permission has a terminal policy call
permissions.forEach(p -> { /* ensure permit/deny/roles/permissions/policy/authenticated was called */ });

try { Policy pol = ((HttpPermissionCarrier) perm).getPolicy(); } catch (IllegalStateException e) { if (!e.getMessage().startsWith("Authorization Policy has not been set")) throw e; }

When it happens

Trigger: Building a HttpPermission via paths(...) and terminating with methods()/paths modifiers but never calling permit/deny/roles/permissions/policy/authorization/authenticated, then the recorder asks for its Policy.

Common situations: Programmatic HttpSecurity setup where an early return/condition skipped the policy call; refactors that removed a permit()/deny() terminator; custom code consuming HttpPermissionCarrier.getPolicy() directly.

Understand the failure class

Background: "X is required", "must be set", "cannot be empty": the missing-required-config error family, from Vertex AI project/location to WeChat keys — this error's family across 18 libraries.

Related errors

• Authorization has already been set
• Endpoint '${classAndMethodName}' requires named HttpSecurity
• Dev services for ${request.getName()} requires a startable s
• This cache is not an instance of
• Could not initialize mapped class ${className}

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/768cdf6ba8daacfc. Report an issue: GitHub.