What causes "This method must not be invoked" in quarkusio/quarkus?

Ensure the request goes through the OIDC code-flow redirect (no active session cookie) before this endpoint is called

quarkusio/quarkus · error · InternalServerErrorException

This method must not be invoked

Error message

This method must not be invoked

What it means

This is a deliberate sentinel thrown by an integration-test endpoint that must never be reached. ProtectedResource2's callback-before-redirect path exists only to assert that Quarkus OIDC redirects the user to the identity provider before any protected resource code executes; if this method runs, the OIDC code-flow redirect did not happen as expected.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource2.java:30

@Path("/web-app2")
@Authenticated
public class ProtectedResource2 {

    @Inject
    @IdToken
    JsonWebToken idToken;

    @GET
    @Path("name")
    public String getName() {
        return "web-app2:" + idToken.getName();
    }

    @GET
    @Path("callback-before-redirect")
    public String getNameCallbackBeforeRedirect() {
        throw new InternalServerErrorException("This method must not be invoked");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

Ensure the request goes through the OIDC code-flow redirect (no active session cookie) before this endpoint is called
Check quarkus-oidc tenant configuration so the path requires authentication and triggers a redirect
If testing intentionally, use an endpoint that does not throw, or remove the call

Example fix

// before
@GET
@Path("callback-before-redirect")
public String getNameCallbackBeforeRedirect() {
    throw new InternalServerErrorException("This method must not be invoked");
}
// after
// Reach this path only via the OIDC redirect flow; if it must be callable,
// replace the throw with the real implementation:
@GET
@Path("callback-before-redirect")
public String getNameCallbackBeforeRedirect() {
    return "web-app2:" + idToken.getName();
}

Defensive patterns

Strategy: validation

Validate before calling

if (uri.getPath().contains("callback-before-redirect") && securityIdentity.isAnonymous()) {
    // expected: OIDC must redirect anonymous users before this endpoint runs
    throw new IllegalStateException("expected OIDC redirect before reaching resource");
}

Try / catch

try {
    String name = given().redirects().follow(false).when().get("/web-app2/callback-before-redirect");
} catch (InternalServerErrorException e) {
    // code-flow redirect did not occur; inspect state cookie configuration
}

Prevention

Always enter protected OIDC resources through the authentication redirect, never direct URLs
Verify state cookie is cleared before testing pre-redirect behavior
Assert 302 to the provider, not 500, in flow tests

When it happens

Trigger: A request hits /web-app2/callback-before-redirect without first being redirected through the Keycloak OIDC authentication flow — i.e. the state cookie / code-flow handshake was skipped or the endpoint was authenticated when it should have forced a redirect.

Common situations: Running CodeFlowTest scenarios where authentication should redirect before reaching the resource; misconfigured quarkus-oidc properties (e.g. allow-anonymous or wrong auth paths) that let the request bypass the redirect; calling the endpoint directly with a tool like curl while carrying a valid session.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/9194e1a3bad9bd59. Report an issue: GitHub.