quarkusio/quarkus · error · WebSocketServerException

Only SecurityIdentity attached to a WebSocket server connect

Error message

Only SecurityIdentity attached to a WebSocket server connection can be updated

What it means

WebSocketSecurity.updateSecurityIdentity(accessToken) resolves the current connection via the connection supplier and expects it to be a WebSocketConnectionImpl carrying a securitySupport. If the supplier returns null, a client connection, or anything else (i.e. there is no server connection bound to the current duplicated context), this WebSocketServerException is thrown.

Source

Thrown at extensions/websockets-next/runtime/src/main/java/io/quarkus/websockets/next/runtime/WebSocketServerRecorder.java:319

                    }
                }
                if (updateNotSupported) {
                    throw new WebSocketServerException("""
                            The '%s' CDI bean injection point was detected, but there is no '%s' that supports '%s'.
                            Either add Quarkus extension that supports SecurityIdentity update like Quarkus OIDC, or
                            implement the provider yourself.
                            """.formatted(WebSocketSecurity.class.getName(), IdentityProvider.class.getName(),
                            WebSocketIdentityUpdateRequest.class.getName()));
                }
                final IdentityProviderManager identityProviderManager = ctx.getInjectedReference(IdentityProviderManager.class);
                return new WebSocketSecurity() {
                    @Override
                    public CompletionStage<SecurityIdentity> updateSecurityIdentity(String accessToken) {
                        if (connectionSupplier.get() instanceof WebSocketConnectionImpl connection) {
                            SecuritySupport securitySupport = connection.securitySupport();
                            return securitySupport.updateSecurityIdentity(accessToken, connection, identityProviderManager);
                        }
                        throw new WebSocketServerException(
                                "Only SecurityIdentity attached to a WebSocket server connection can be updated");
                    }
                };
            }
        };
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Only call updateSecurityIdentity inside server WebSocket endpoint methods/callbacks running on the connection's duplicated context
2. Verify you are not in a WebSocket client endpoint (client connections are not supported)
3. Move identity update logic into the endpoint handler or an onMessage/onOpen callback
4. Check that the connection is still open when the update is performed

Example fix

// before
@Scheduled(every = "10s")
void refresh() { security.updateSecurityIdentity(token); } // no server connection context
// after
@OnMessage
void onMessage(String msg) {
    security.updateSecurityIdentity(token); // runs on server connection context
}

if (Vertx.currentContext() == null) {
    throw new IllegalStateException("updateSecurityIdentity must run on a WebSocket server connection context");
}

static boolean canUpdateIdentity(WebSocketSecurity security) {
    io.vertx.core.Context ctx = Vertx.currentContext();
    return ctx != null && io.quarkus.websockets.next.runtime.VertxContext.isDuplicatedContext(ctx);
}

try {
    security.updateSecurityIdentity(token);
} catch (WebSocketServerException e) {
    log.error("Call updateSecurityIdentity only from a server endpoint callback", e);
}

When it happens

Trigger: Calling updateSecurityIdentity from code that is not executing within a WebSocket server endpoint's duplicated context (background thread, non-endpoint request), or from a WebSocket client endpoint where the supplied object is not a server WebSocketConnectionImpl.

Common situations: Calling WebSocketSecurity from a scheduled job; using the security update API in a client endpoint by mistake; invoking the API after the server connection closed.

Related errors

• New SecurityIdentity principal name '%s' is different than p
• Unable to obtain the connection from the Vert.x duplicated c
• Principal is null but anonymous status is false
• Updated SecurityIdentity is anonymous
• Unable to obtain the connection from the Vert.x duplicated c

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/930507edb0a6b4b0. Report an issue: GitHub.