quarkusio/quarkus · error · IllegalStateException

CDI container is not available, cannot initialize HTTP Secur

Error message

CDI container is not available, cannot initialize HTTP Security configuration

What it means

HTTP Security configuration initialization needs the CDI container to look up observers/beans, but the container reference was null. In DEVELOPMENT mode this is tolerated during restart-after-failed-build (returns isNotReady=true), but in other modes it fails fast with IllegalStateException because security configuration (TLS, client auth, events) cannot be safely initialized.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityConfiguration.java:490

     * authentication are loaded. It is unnecessary to use this method inside this HTTP Security package.
     *
     * @return true if programmatic configuration is ready
     */
    public static boolean isNotReady(VertxHttpConfig httpConfig, VertxHttpBuildTimeConfig httpBuildTimeConfig,
            LaunchMode launchMode) {
        if (instance != null) {
            return false;
        }

        var container = Arc.container();
        if (container == null) {
            if (launchMode == LaunchMode.DEVELOPMENT) {
                // there is one exception when we know that CDI container can be null and that is when server is starting
                // after failed start (e.g. compilation error was fixed); we document this known limitation and it is
                // only relevant for TLS config and TLS client auth, we must fail for everything else
                return true;
            } else {
                throw new IllegalStateException(
                        "CDI container is not available, cannot initialize HTTP Security configuration");
            }
        } else if (isHttpSecurityEventNotObserved(container)) {
            return false;
        }

        get(httpConfig, httpBuildTimeConfig);
        return false;
    }

    public static CSRF getProgrammaticCsrfConfig(VertxHttpConfig httpConfig, VertxHttpBuildTimeConfig httpBuildTimeConfig) {
        var container = Arc.container();
        if (container == null || isHttpSecurityEventNotObserved(container)) {
            // return null for example if the security extension is not present, or if user doesn't use the HttpSecurity
            return null;
        }
        return get(httpConfig, httpBuildTimeConfig).csrf;
    }

View on GitHub (pinned to e1c734241f)

Solutions

Ensure the application boots normally in the target mode; verify no build/startup step forces HTTP security init before the CDI container exists.
If triggered in dev mode after a failed restart, fix the underlying compilation/startup error and let dev mode restart cleanly.
Check extensions that start the HTTP server; update/align them so they run after CDI init (Arc.container() != null).
Reproduce with -Dquarkus.log.category."io.quarkus.vertx.http".level=DEBUG to see which config path hit the null container.
Report/inspect if it only occurs in tests with custom QuarkusApplication or manual HTTP recorder invocation.

Example fix

// before: security policy initialized eagerly before CDI is ready in prod
// after: guard startup order or run init on an event that fires after CDI is available
if (Arc.container() == null) {
    throw new IllegalStateException("HTTP Security init must run after CDI container start");
}

Defensive patterns

Strategy: validation

Validate before calling

if (io.quarkus.arc.Arc.container() == null && LaunchMode.current() != LaunchMode.DEVELOPMENT) {
    throw new IllegalStateException("Cannot init HTTP security before CDI container is available");
}

Try / catch

try {
    securityInit();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("CDI container is not available")) {
        // defer init until after container start / observe StartedEvent
    } else throw e;
}

Prevention

Initialize security from an CDI observer of container startup events
Keep dev-mode compile errors fixed promptly to avoid half-restarts
Ensure custom extensions do not start HTTP before ArC

When it happens

Trigger: HttpSecurityConfiguration.isNotReady() runs during HTTP server start with container == null outside DEVELOPMENT mode — e.g. prod/test startup ordering where the HTTP security policy initializes before ArC finished, or a failed launch path re-initializing config.

Common situations: Prod-mode builds with the HTTP security policy active but CDI not yet available at HTTP init; custom extensions starting the HTTP layer too early; corrupted/restarted dev-mode state where the documented limitation for TLS config is exceeded.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/5361a3cc44292b81. Report an issue: GitHub.