quarkusio/quarkus · error · RuntimeException

Endpoint '${classAndMethodName}' requires named HttpSecurity

Error message

Endpoint '${classAndMethodName}' requires named HttpSecurityPolicy '${policyName}' specified with '@AuthorizationPolicy',
but no such policies has bean found. Please provide required policy as CDI bean.

What it means

An endpoint annotated with @AuthorizationPolicy referencing a named HttpSecurityPolicy requires a CDI bean exposing that policy name. JaxRsPathMatchingHttpSecurityPolicy builds the name→policy map at startup; if an annotation references a name with no matching bean, it throws a RuntimeException naming the endpoint class#method.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java:69

                if (installedPolicy.name() != null) {
                    var previousPolicy = allPolicies.put(installedPolicy.name(), installedPolicy);
                    if (previousPolicy != null) {
                        throw duplicateNamedPoliciesNotAllowedEx(previousPolicy, installedPolicy);
                    }
                }
            }
            var annotationPoliciesOnly = new HashMap<String, HttpSecurityPolicy>();
            for (Map.Entry<MethodDescription, String> e : storage.getMethodToPolicyName().entrySet()) {
                var policyName = e.getValue();
                if (annotationPoliciesOnly.containsKey(policyName)) {
                    continue;
                }
                if (allPolicies.containsKey(policyName)) {
                    annotationPoliciesOnly.put(policyName, allPolicies.get(policyName));
                    continue;
                }
                var classAndMethodName = e.getKey().getClassName() + "#" + e.getKey().getMethodName();
                throw new RuntimeException("""
                        Endpoint '%s' requires named HttpSecurityPolicy '%s' specified with '@AuthorizationPolicy',
                        but no such policies has bean found. Please provide required policy as CDI bean.
                        """.formatted(classAndMethodName, policyName));
            }
            policyNameToPolicy = Map.copyOf(annotationPoliciesOnly);
        }
        for (var httpPermission : HttpSecurityConfiguration.get().httpPermissions()) {
            if (httpPermission.shouldApplyToJaxRs() && httpPermission.getAuthMechanisms() != null) {
                // HTTP authentication mechanism is selected by HTTP authenticator that
                // uses the AbstractPathMatchingHttpSecurityPolicy in the RoutingContext
                // we cannot support this without bigger refactoring and the whole point of JAX-RS policy was to support
                // the authentication annotations like @BasicAuthentication, so it doesn't make sense to support it
                throw new ConfigurationException("""
                        HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process
                        has completed, therefore this policy can not be used to select '%s' authentication mechanism
                        """.formatted(httpPermission.getAuthMechanisms().names()));
            }
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Create/register a CDI bean implementing HttpSecurityPolicy with a @Named value exactly matching the annotation's name.
2. Fix any typo in the @AuthorizationPolicy name attribute.
3. Verify the policy bean is in an indexed/discovered package (add @ApplicationScoped or appropriate scope).

Example fix

// before
@AuthorizationPolicy(name = "custum-policy")
// after
@AuthorizationPolicy(name = "custom-policy")
// and ensure:
@ApplicationScoped
@Named("custom-policy")
public class CustomPolicy implements HttpSecurityPolicy { ... }

// before startup, ensure bean exists for every @AuthorizationPolicy name
Set<String> declared = scanAuthorizationPolicyNames(); // from annotations
Set<String> provided = beanManager.getBeans(HttpSecurityPolicy.class)
    .stream().map(b -> beanManager.qualifiers(b)) // collect @Named values
    .collect(Collectors.toSet());
if (!provided.containsAll(declared)) throw new IllegalStateException("missing policy beans: " + declared);

try {
  startApplication();
} catch (RuntimeException e) {
  if (e.getMessage() != null && e.getMessage().contains("@AuthorizationPolicy")) {
    log.error("Register a CDI bean named '{}' implementing HttpSecurityPolicy");
  }
}

When it happens

Trigger: @AuthorizationPolicy(name="my-policy") on a REST resource where no HttpSecurityPolicy bean named 'my-policy' is registered (missing bean, wrong name, bean not discovered).

Common situations: Typo in the policy name, forgetting to annotate the policy bean with @Named or to make it a CDI bean, or the policy class not being in a bean-discovering package.

Related errors

• Authorization has already been set
• Authorization Policy has not been set for paths:
• Multiple @Inject constructors on ${theClass}
• Quarkus does not support CDI Full @Specializes annotation; t
• IllegalStateException wrapping ClassNotFoundException for ge

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/03c33839e47b3341. Report an issue: GitHub.