quarkusio/quarkus · error · IllegalStateException

Registering default SecurityCheck that requires secured meth

Error message

Registering default SecurityCheck that requires secured method arguments is not supported

What it means

EagerSecurityHandler builds a per-method security handler chain. If the resolved SecurityCheckInfo is the default JAX-RS check AND requires secured method arguments, the current architecture has no handler able to pass method arguments for the default check, so it fails fast. The code notes this should be unreachable today — it is a defensive guard.

Source

Thrown at extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java:243

        private volatile SecurityCheckInfo securityCheckInfo;

        @Override
        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,
                ServerResourceMethod serverResourceMethod) {
            if (phase == Phase.AFTER_MATCH) {
                final SecurityCheckInfo info = getSecurityCheckInfo(serverResourceMethod);
                return List.of(new EagerSecurityHandler(info.check, info.isDefaultJaxRsSecCheck, info.invokedMethodDesc));
            }

            if (phase == Phase.BEFORE_METHOD_INVOKE && requiresMethodArguments(serverResourceMethod)) {
                final SecurityCheckInfo info = getSecurityCheckInfo(serverResourceMethod);
                if (info.isDefaultJaxRsSecCheck) {
                    // with current implementation, this IF will never be true as the default checks are about
                    // default @RolesAllowed or @Deny configurable in application.properties for unannotated methods;
                    // it is difficult to imagine check that requires method arguments and is applied for all methods;
                    // if this was ever implemented, respective server handler needs to be updated accordingly
                    throw new IllegalStateException(
                            "Registering default SecurityCheck that requires secured method arguments is not supported");
                }
                return List.of(new SecurityCheckWithMethodArgsHandler(info.check, info.invokedMethodDesc));
            }

            return List.of();
        }

        private boolean requiresMethodArguments(ServerResourceMethod serverResourceMethod) {
            return getSecurityCheckInfo(serverResourceMethod).check.requiresMethodArguments();
        }

        private SecurityCheckInfo getSecurityCheckInfo(ServerResourceMethod serverResourceMethod) {
            if (securityCheckInfo == null) {
                boolean isDefaultJaxRsSecCheck = false;
                var desc = ResourceMethodDescription.of(serverResourceMethod);
                var checkStorage = Arc.container().instance(SecurityCheckStorage.class).get();

View on GitHub (pinned to e1c734241f)

Solutions

Implement the check as an explicit annotation-based SecurityCheck (applied per-method), not the default check
Ensure the default security check does not require method arguments (drop the arguments requirement)
Use a server request filter or custom handler to implement argument-dependent authorization instead
Upgrade Quarkus — if this surfaces from framework code, it indicates a framework bug; report it

Defensive patterns

Strategy: try-catch

Validate before calling

// when registering a default SecurityCheck, assert it doesn't require method args
if (defaultCheck.requiresMethodArguments()) {
    throw new IllegalArgumentException("Default SecurityCheck must not require method arguments");
}

Try / catch

try {
    handlers();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("requires secured method arguments")) {
        // replace the default check with an annotation-based check
    } else throw e;
}

Prevention

Design default checks (deny-unannotated) without method-argument requirements
Use per-method annotation checks when authorization needs method parameters
Prefer server request filters for argument-dependent authorization

When it happens

Trigger: A custom SecurityCheck registered as the default check declares that it requires method arguments (e.g. via @MethodPermission or check signature needing method params) while being installed as the default (unannotated-method) check.

Common situations: Writing a custom security check extension that registers a default check via build steps while its implementation demands method arguments; future/refactored Quarkus security check implementations.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/15d48e49d577e0ef. Report an issue: GitHub.