quarkusio/quarkus · error · ConfigurationException

HTTP permission path '' contains inner wildcard enclosed wit

Error message

HTTP permission path '' contains inner wildcard enclosed with a path character other than a separator. The inner wildcard must represent exactly one path segment. Please see this Quarkus guide for more information: https://quarkus.io/guides/security-authorize-web-endpoints-reference

What it means

In Quarkus HTTP authorization paths, a wildcard '*' is only allowed as a whole trailing or standalone segment. When a wildcard appears in the middle of a path, ImmutablePathMatcher requires it to be enclosed by path separators (e.g. /one/*/two); patterns like /one*/two or /one/*two are rejected with a ConfigurationException pointing to the Quarkus authorization guide.

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/ImmutablePathMatcher.java:278

        private void addWildcardPath(String path, T handler, int wildcardIdx, String originalPath) {
            final int lastIdx = path.length() - 1;
            final String pathWithWildcard;
            final String pathAfter1stWildcard;

            if (lastIdx == wildcardIdx) {
                // ends with a wildcard => it's a prefix path
                pathWithWildcard = path;
                pathAfter1stWildcard = null;
            } else {
                // contains at least one inner wildcard: /one/*/three, /one/two/*/four/*, ...
                // the inner wildcard represents exactly one path segment
                pathWithWildcard = path.substring(0, wildcardIdx + 1);
                pathAfter1stWildcard = path.substring(wildcardIdx + 1);

                // validate that inner wildcard is enclosed with path separators like: /one/*/two
                // anything like: /one*/two, /one/*two/, /one/tw*o/ is not allowed
                if (!pathWithWildcard.endsWith("/*") || !pathAfter1stWildcard.startsWith("/")) {
                    throw new ConfigurationException("HTTP permission path '" + originalPath + "' contains inner "
                            + "wildcard enclosed with a path character other than a separator. The inner wildcard "
                            + "must represent exactly one path segment. Please see this Quarkus guide for more "
                            + "information: https://quarkus.io/guides/security-authorize-web-endpoints-reference");
                }
            }

            final String pathWithoutWildcard;
            if (pathWithWildcard.endsWith("/*")) {
                // remove /*
                String stripped = pathWithWildcard.substring(0, pathWithWildcard.length() - 2);
                pathWithoutWildcard = stripped.isEmpty() ? "/" : stripped;
            } else {
                // remove *
                pathWithoutWildcard = pathWithWildcard.substring(0, pathWithWildcard.length() - 1);
            }

            Path<T> p = pathsWithWildcard.computeIfAbsent(pathWithoutWildcard, Path::new);
            p.originalPath = originalPath;

View on GitHub (pinned to e1c734241f)

Solutions

1. Rewrite the pattern so the wildcard is its own segment: use /api/* instead of /api*, or /api/*/v2 for middle wildcards.
2. If prefix matching is needed, list the exact paths or use a custom HttpSecurityPolicy.
3. Consult https://quarkus.io/guides/security-authorize-web-endpoints-reference for allowed wildcard syntax.

Example fix

// before (application.properties)
quarkus.http.auth.permission.admin.paths=/admin*
// after
quarkus.http.auth.permission.admin.paths=/admin/*

boolean validWildcardPath(String p) {
  int i = p.indexOf('*');
  if (i < 0) return p.startsWith("/");
  return p.startsWith("/") && (i == p.length() - 1 || (p.charAt(i-1) == '/' && p.charAt(i+1) == '/'));
}

When it happens

Trigger: Adding a wildcard path via addPath/addWildcardPath where the character before '*' or the character right after it is not a path separator, e.g. quarkus.http.auth.permission.p1.paths=/api/v1* or /api*/v2.

Common situations: Users trying to express prefix matching like /api* instead of /api/*, or suffix matching like *.html in permission paths in application.properties.

Related errors

• TLS client authentication is not available, please enable it
• Path must always start with a path separator, but was '' cre
• Path not specified
• HttpSecurityPolicy that applies to JAXRS can be effective on
• Failed to load application configuration

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/faf5227ed08e0c98. Report an issue: GitHub.