quarkusio/quarkus · error · InternalServerErrorException

This method must not be invoked

Error message

This method must not be invoked

What it means

Deliberate sentinel in ProtectedResource3. This endpoint should never return successfully: the CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie scenario verifies that when a state cookie is missing during code-flow completion, Quarkus OIDC returns 401 instead of completing authentication. If the method body executes, authentication incorrectly succeeded without the state cookie.

Solutions

1. Verify the state cookie is being set on the initial redirect and sent back on the callback (check cookie domain/path/secure settings)
2. Confirm the OIDC extension version still enforces the state-cookie check (401 on missing cookie)
3. Fix the test/flow so the callback carries the state cookie before this endpoint can be reached

Example fix

// before
@GET
public String getName() {
    throw new InternalServerErrorException("This method must not be invoked");
}
// after
// Endpoint must stay unreachable; correct the flow so OIDC returns 401:
// ensure the state cookie (q_auth) is present when the redirect returns
to this resource; then this method is never executed.

if (oidcAuthenticationCompletionSucceeded() && stateCookieMissing()) {
    throw new IllegalStateException("state cookie check bypassed: expected 401");
}

try {
    given().get("/protected-resource-3");
} catch (InternalServerErrorException e) {
    // authentication completed without a state cookie; check q_auth cookie handling
}

When it happens

Trigger: A redirect targets this endpoint and OIDC authentication completes even though the state cookie was absent — meaning the CSRF/state-cookie check was bypassed or misconfigured.

Common situations: Testing incomplete/failed code-flow callbacks; OIDC state cookie dropped by browser or cookie-domain misconfiguration; upgrading Quarkus and expecting the 401-on-missing-state-cookie behavior to hold.

Related errors

• Invalid redirect URI
• Secret key for encrypting state cookie is less than 16…
• State cookie value for the
• /tenant-restore-path-absolute-redirect must be restored
• This method must not be invoked

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d58980349fe2d15c. Report an issue: GitHub.

Appendix: source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource3.java:17

package io.quarkus.it.keycloak;

import jakarta.ws.rs.GET;
import jakarta.ws.rs.InternalServerErrorException;
import jakarta.ws.rs.Path;

import io.quarkus.security.Authenticated;

@Path("/web-app3")
@Authenticated
public class ProtectedResource3 {

    @GET
    public String getName() {
        // CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie checks that if a state cookie is missing
        // then 401 is returned when a redirect targets the endpoint requiring authentication
        throw new InternalServerErrorException("This method must not be invoked");
    }
}

View on GitHub (pinned to e1c734241f)