quarkusio/quarkus · error · ConfigurationException

HttpSecurityPolicy that applies to JAXRS can be effective on

Error message

HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process
has completed, therefore this policy can not be used to select '%s' authentication mechanism

What it means

JAX-RS-matching HttpSecurityPolicies run after authentication, so they cannot be used to choose an authentication mechanism. If a quarkus.http.auth.permission entry both applies to JAX-RS (http.jaxrs=true or annotation-based) and sets auth.mechanism, startup fails with a ConfigurationException naming the mechanism(s).

Source

Thrown at extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/JaxRsPathMatchingHttpSecurityPolicy.java:82

                if (allPolicies.containsKey(policyName)) {
                    annotationPoliciesOnly.put(policyName, allPolicies.get(policyName));
                    continue;
                }
                var classAndMethodName = e.getKey().getClassName() + "#" + e.getKey().getMethodName();
                throw new RuntimeException("""
                        Endpoint '%s' requires named HttpSecurityPolicy '%s' specified with '@AuthorizationPolicy',
                        but no such policies has bean found. Please provide required policy as CDI bean.
                        """.formatted(classAndMethodName, policyName));
            }
            policyNameToPolicy = Map.copyOf(annotationPoliciesOnly);
        }
        for (var httpPermission : HttpSecurityConfiguration.get().httpPermissions()) {
            if (httpPermission.shouldApplyToJaxRs() && httpPermission.getAuthMechanisms() != null) {
                // HTTP authentication mechanism is selected by HTTP authenticator that
                // uses the AbstractPathMatchingHttpSecurityPolicy in the RoutingContext
                // we cannot support this without bigger refactoring and the whole point of JAX-RS policy was to support
                // the authentication annotations like @BasicAuthentication, so it doesn't make sense to support it
                throw new ConfigurationException("""
                        HttpSecurityPolicy that applies to JAXRS can be effective only after an authentication process
                        has completed, therefore this policy can not be used to select '%s' authentication mechanism
                        """.formatted(httpPermission.getAuthMechanisms().names()));
            }
        }
    }

    /**
     * @param securedMethodDesc method description
     * @return true if method is secured with {@link io.quarkus.vertx.http.security.AuthorizationPolicy}
     */
    public boolean requiresAuthorizationPolicy(MethodDescription securedMethodDesc) {
        return storage.requiresAuthorizationPolicy(securedMethodDesc);
    }

    /**
     * @return true if there is no point running {@link #checkPermission(RoutingContext, Uni, MethodDescription)}
     */

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove auth.mechanism from permissions that apply to JAX-RS.
2. Use mechanism selection only on non-JAX-RS permissions, or rely on annotations like @BasicAuthentication on the endpoint.
3. Split the permission into a JAX-RS policy permission and a separate path-based permission for mechanism selection.

Example fix

// before
quarkus.http.auth.permission.p1.jaxrs=true
quarkus.http.auth.permission.p1.auth.mechanism=basic
// after
quarkus.http.auth.permission.p1.jaxrs=true
// (no auth.mechanism; use @BasicAuthentication on the endpoint instead)

// in a startup test: fail if any jaxrs permission defines auth.mechanism
for (var perm : permissions) {
  if (perm.jaxrs && perm.authMechanism != null) {
    throw new IllegalStateException("auth.mechanism not allowed on jaxrs permission " + perm.name);
  }
}

When it happens

Trigger: Configuring a permission like quarkus.http.auth.permission.p1.jaxrs=true together with quarkus.http.auth.permission.p1.auth.mechanism=basic (or form/other mechanisms).

Common situations: Developers wanting JAX-RS annotation-driven policies (e.g. @BasicAuthentication) while also assigning auth.mechanism in the same permission block, misunderstanding the evaluation order.

Understand the failure class

• Authentication and authorization failures — expired tokens, bad credentials, and missing scopes.

Related errors

• TLS client authentication is not available, please enable it
• Path must always start with a path separator, but was '' cre
• HTTP permission path '' contains inner wildcard enclosed wit
• Path not specified
• Failed to load application configuration

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/654bb956d3a6417c. Report an issue: GitHub.