quarkusio/quarkus · error · IllegalStateException

Security annotation placed on resource method '${className}#

Error message

Security annotation placed on resource method '${className}#${methodName}' wasn't detected by Quarkus during the build time. Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.

What it means

getSecurityCheckInfo resolves the SecurityCheck for a resource method from the build-time populated check storage. If no check (standard security annotation mapping or the default configured check) is found for the method, the security annotation was not recorded during build, so it throws IllegalStateException pointing at the CDI bean discovery documentation.

Source

Thrown at extensions/resteasy-reactive/rest/runtime/src/main/java/io/quarkus/resteasy/reactive/server/runtime/security/EagerSecurityHandler.java:272

        }

        private SecurityCheckInfo getSecurityCheckInfo(ServerResourceMethod serverResourceMethod) {
            if (securityCheckInfo == null) {
                boolean isDefaultJaxRsSecCheck = false;
                var desc = ResourceMethodDescription.of(serverResourceMethod);
                var checkStorage = Arc.container().instance(SecurityCheckStorage.class).get();

                var check = checkStorage.getSecurityCheck(desc.invokedMethodDesc());
                if (check == null && desc.fallbackMethodDesc() != null) {
                    check = checkStorage.getSecurityCheck(desc.fallbackMethodDesc());
                }
                if (check == null) {
                    check = checkStorage.getDefaultSecurityCheck();
                    isDefaultJaxRsSecCheck = true;
                }

                if (check == null) {
                    throw new IllegalStateException(
                            """
                                    Security annotation placed on resource method '%s#%s' wasn't detected by Quarkus during the build time.
                                    Please consult https://quarkus.io/guides/cdi-reference#bean_discovery on how to make the module containing the code discoverable by Quarkus.
                                    """
                                    .formatted(desc.invokedMethodDesc().getClassName(),
                                            desc.invokedMethodDesc().getMethodName()));
                }

                securityCheckInfo = new SecurityCheckInfo(check, isDefaultJaxRsSecCheck, desc.invokedMethodDesc());
            }

            return securityCheckInfo;
        }

        private record SecurityCheckInfo(SecurityCheck check, boolean isDefaultJaxRsSecCheck,
                MethodDescription invokedMethodDesc) {

        }

View on GitHub (pinned to e1c734241f)

Solutions

Index the containing module with Jandex or add META-INF/beans.xml so Quarkus can discover it
Clean rebuild the application (./mvnw clean install)
Move the resource class into an application module that Quarkus indexes
Confirm the annotation is a supported Quarkus security annotation and not shadowed by an import of a same-named annotation from another package

Example fix

// before: annotation from wrong package
import javax.annotation.security.RolesAllowed;
// after
import jakarta.annotation.security.RolesAllowed;

Defensive patterns

Strategy: validation

Validate before calling

// ensure the annotation is the supported one and the module is indexed
Class<?> ra = Class.forName("jakarta.annotation.security.RolesAllowed");
if (!method.getAnnotation(ra).equals(usedAnnotation)) {
    throw new IllegalStateException("Wrong RolesAllowed import — use jakarta.annotation.security");
}

Try / catch

try {
    callSecuredEndpoint();
} catch (IllegalStateException e) {
    if (e.getMessage().contains("wasn't detected by Quarkus")) {
        // add Jandex index / beans.xml to the containing module and rebuild
    } else throw e;
}

Prevention

Use jakarta.annotation.security.* annotations, not javax or other look-alikes
Index dependency jars containing secured resources
Clean rebuild after adding security annotations; restart dev mode on hot-reload oddities

When it happens

Trigger: A resource method with a security annotation (@RolesAllowed, @PermitAll, @DenyAll) lives in a class that was not indexed/processed at build time (non-discoverable jar), or deny-unannotated configuration references a method whose class was never scanned, or stale build output after adding the annotation.

Common situations: Security annotations in external library jars without Jandex index; adding annotations without a clean rebuild; classes in modules not part of the Quarkus application index; dev-mode hot reload glitches.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f6753fd082c25f68. Report an issue: GitHub.