quarkusio/quarkus · error · IllegalStateException

Security annotation placed on resource method '${className}#

Error message

Security annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.

What it means

EagerSecurityInterceptorHandler looks up the build-time registered security interceptor for the invoked (or fallback) resource method. If none is found, the security annotation on that method was never processed at build time, and startup/request handling fails with IllegalStateException pointing to the bean discovery guide.

Source

Thrown at extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityInterceptorHandler.java:56

        public static HandlerChainCustomizer newInstance() {
            return new Customizer();
        }

        @Override
        public List<ServerRestHandler> handlers(Phase phase, ResourceClass resourceClass,
                ServerResourceMethod serverResourceMethod) {
            if (phase == Phase.AFTER_MATCH) {

                var desc = ResourceMethodDescription.of(serverResourceMethod);
                var interceptorStorage = Arc.container().instance(EagerSecurityInterceptorStorage.class).get();
                var interceptor = interceptorStorage.getInterceptor(desc.invokedMethodDesc());
                if (interceptor == null && desc.fallbackMethodDesc() != null) {
                    interceptor = interceptorStorage.getInterceptor(desc.fallbackMethodDesc());
                }

                if (interceptor == null) {
                    throw new IllegalStateException(
                            """
                                    Security annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.
                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.
                                    """
                                    .formatted(desc.invokedMethodDesc().getClassName(),
                                            desc.invokedMethodDesc().getMethodName()));
                }

                return Collections.singletonList(new EagerSecurityInterceptorHandler(interceptor));
            }
            return Collections.emptyList();
        }

    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Add a Jandex index (jandex-maven-plugin) or beans.xml to the module containing the resource
Clean rebuild the application so interceptor storage includes the method
Move the resource into an indexed application module
Align Quarkus extension versions with the platform BOM and restart dev mode

Example fix

// library pom: index it
<plugin>
  <groupId>io.smallrye</groupId>
  <artifactId>jandex-maven-plugin</artifactId>
  <executions><execution><goals><goal>jandex</goal></goals></execution></executions>
</plugin>

Defensive patterns

Strategy: validation

Validate before calling

// confirm the resource module is discoverable before deployment
Path idx = Path.of("target/classes/META-INF/jandex.idx");
if (Files.notExists(idx) && Files.notExists(Path.of("src/main/resources/META-INF/beans.xml"))) {
    throw new IllegalStateException("Add Jandex index or beans.xml for security-annotated resources");
}

Try / catch

try {
    callSecuredEndpoint();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("wasn't detected by Quarkus")) {
        // index the module and rebuild; verify interceptor registration build step ran
    } else throw e;
}

Prevention

Jandex-index every module that holds secured resources
Keep Quarkus versions aligned across extensions so interceptor build steps run
Restart dev mode after adding security annotations to hot-reloaded classes

When it happens

Trigger: A resource method carrying a security annotation is served by Quarkus REST but its class was not part of the build-time index (unindexed dependency jar), the interceptor storage was built before the annotation existed, or fallback/invoked method descriptions don't match any registered interceptor.

Common situations: Resources in separate library modules without Jandex indexing; annotation added but application not rebuilt; mismatched Quarkus versions where the interceptor registration build step did not run.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/dbe310ca84a33afd. Report an issue: GitHub.