quarkusio/quarkus · error · IllegalStateException

@AuthorizationPolicy annotation placed on resource method '$

Error message

@AuthorizationPolicy annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.

What it means

At runtime, EagerSecurityHandler determines whether a resource method needs an @AuthorizationPolicy check by consulting the AuthorizationPolicyStorage populated at build time. If neither the invoked nor fallback method description is registered, the annotation was not seen during build (the class wasn't part of Jandex/bean discovery), so it throws IllegalStateException with a link to the CDI bean discovery docs.

Source

Thrown at extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java:210

            }
            return List.of();
        }
    }

    public static final class AuthZPolicyCustomizer implements HandlerChainCustomizer {
        @Override
        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,
                ServerResourceMethod serverResourceMethod) {
            if (phase == Phase.AFTER_MATCH) {
                var desc = ResourceMethodDescription.of(serverResourceMethod);
                var authorizationPolicyStorage = Arc.container().select(AuthorizationPolicyStorage.class).get();
                final MethodDescription securedMethod;
                if (authorizationPolicyStorage.requiresAuthorizationPolicy(desc.invokedMethodDesc())) {
                    securedMethod = desc.invokedMethodDesc();
                } else if (authorizationPolicyStorage.requiresAuthorizationPolicy(desc.fallbackMethodDesc())) {
                    securedMethod = desc.fallbackMethodDesc();
                } else {
                    throw new IllegalStateException(
                            """
                                    @AuthorizationPolicy annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.
                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.
                                    """
                                    .formatted(desc.invokedMethodDesc().getClassName(),
                                            desc.invokedMethodDesc().getMethodName()));
                }
                return List.of(new EagerSecurityHandler(null, false, securedMethod));
            }
            return List.of();
        }
    }

    public static final class HttpPermissionsAndSecurityChecksCustomizer implements HandlerChainCustomizer {

        private volatile SecurityCheckInfo securityCheckInfo;

        @Override

View on GitHub (pinned to e1c734241f)

Solutions

Make the module containing the resource discoverable: add a META-INF/beans.xml (bean-discovery-mode all) or add it as a Jandex-indexed dependency (jandex-maven-plugin)
Rebuild the application (./mvnw clean install) after adding the annotation
Move the resource class into the application or an indexed Quarkus extension module
Verify the method description matches — remove duplicated method signatures that could confuse invoked vs fallback method resolution

Example fix

// library pom: make it indexable
<plugin>
  <groupId>io.smallrye</groupId>
  <artifactId>jandex-maven-plugin</artifactId>
  <executions><execution><goals><goal>jandex</goal></goals></execution></executions>
</plugin>

Defensive patterns

Strategy: validation

Validate before calling

// verify the resource module is Jandex-indexed before relying on @AuthorizationPolicy
boolean indexed = new File(moduleDir, "META-INF/jandex.idx").exists()
        || new File(moduleDir, "META-INF/beans.xml").exists();
if (!indexed) throw new IllegalStateException("Module must be Jandex-indexed for @AuthorizationPolicy");

Try / catch

try {
    securedEndpointCall();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("@AuthorizationPolicy")) {
        // fix bean discovery: add jandex index / beans.xml and rebuild
    } else throw e;
}

Prevention

Index all library modules containing resources (jandex-maven-plugin or beans.xml)
Clean rebuild after adding security annotations
Keep resource classes in modules that participate in Quarkus bean discovery

When it happens

Trigger: A resource method annotated with @AuthorizationPolicy lives in a module not discoverable at build time (no beans.xml, not indexed by Jandex — e.g. a plain jar dependency outside the application), or the annotation was added without rebuilding, or a proxy/fallback method mismatch.

Common situations: Placing resources in a shared library jar not indexed by Quarkus; adding @AuthorizationPolicy in a multi-module project where the module isn't a Quarkus-managed dependency; stale incremental builds.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/ebb827bfdd510fc8. Report an issue: GitHub.