quarkusio/quarkus · error · InternalServerErrorException

This method must not be invoked

Error message

This method must not be invoked

What it means

Deliberate sentinel in ProtectedResource3. This endpoint should never return successfully: the CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie scenario verifies that when a state cookie is missing during code-flow completion, Quarkus OIDC returns 401 instead of completing authentication. If the method body executes, authentication incorrectly succeeded without the state cookie.

Source

Thrown at integration-tests/oidc-code-flow/src/main/java/io/quarkus/it/keycloak/ProtectedResource3.java:17

package io.quarkus.it.keycloak;

import jakarta.ws.rs.GET;
import jakarta.ws.rs.InternalServerErrorException;
import jakarta.ws.rs.Path;

import io.quarkus.security.Authenticated;

@Path("/web-app3")
@Authenticated
public class ProtectedResource3 {

    @GET
    public String getName() {
        // CodeFlowTest#testAuthenticationCompletionFailedNoStateCookie checks that if a state cookie is missing
        // then 401 is returned when a redirect targets the endpoint requiring authentication
        throw new InternalServerErrorException("This method must not be invoked");
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Verify the state cookie is being set on the initial redirect and sent back on the callback (check cookie domain/path/secure settings)
2. Confirm the OIDC extension version still enforces the state-cookie check (401 on missing cookie)
3. Fix the test/flow so the callback carries the state cookie before this endpoint can be reached

Example fix

// before
@GET
public String getName() {
    throw new InternalServerErrorException("This method must not be invoked");
}
// after
// Endpoint must stay unreachable; correct the flow so OIDC returns 401:
// ensure the state cookie (q_auth) is present when the redirect returns
to this resource; then this method is never executed.

if (oidcAuthenticationCompletionSucceeded() && stateCookieMissing()) {
    throw new IllegalStateException("state cookie check bypassed: expected 401");
}

try {
    given().get("/protected-resource-3");
} catch (InternalServerErrorException e) {
    // authentication completed without a state cookie; check q_auth cookie handling
}

When it happens

Trigger: A redirect targets this endpoint and OIDC authentication completes even though the state cookie was absent — meaning the CSRF/state-cookie check was bypassed or misconfigured.

Common situations: Testing incomplete/failed code-flow callbacks; OIDC state cookie dropped by browser or cookie-domain misconfiguration; upgrading Quarkus and expecting the 401-on-missing-state-cookie behavior to hold.

Related errors

• State cookie value for the %s tenant can not be encrypted: %
• Secret key for encrypting state cookie is less than 16 chara
• This method must not be invoked
• Invalid redirect URI
• /tenant-restore-path-absolute-redirect must be restored

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/d58980349fe2d15c. Report an issue: GitHub.