Fix Broken User Authentication in Quarkus

Broken authentication in Quarkus typically stems from developers bypassing the built-in Elytron security architecture in favor of 'quick-and-dirty' custom JAX-RS filters. These manual implementations often lack constant-time comparisons, fail to handle token expiration correctly, and are susceptible to credential stuffing when backed by weak hashing. To secure a Quarkus microservice, you must shift from manual header checks to declarative security using standard OIDC or JWT extensions.

The Vulnerable Pattern

@Provider
public class WeakAuthFilter implements ContainerRequestFilter {
    @Override
    public void filter(ContainerRequestContext requestContext) {
        String authHeader = requestContext.getHeaderString("X-Custom-Auth");
        // VULNERABILITY: Hardcoded token, no constant-time comparison, bypasses Quarkus Security context
        if (authHeader == null || !authHeader.equals("admin-secret-key")) {
            requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build());
        }
    }
}

The Secure Implementation

The vulnerable code uses a custom ContainerRequestFilter that performs a naive string comparison. This is vulnerable to timing attacks and lacks integration with the Quarkus Security Identity. The secure implementation utilizes the 'quarkus-oidc' extension, delegating authentication to a hardened Identity Provider (IdP). It uses '@RolesAllowed' for Role-Based Access Control (RBAC) and ensures that security is handled at the framework level, providing automatic token validation, expiration checks, and cryptographic signature verification.

// application.properties
quarkus.oidc.auth-server-url=https://keycloak.example.com/realms/main
quarkus.oidc.client-id=my-quarkus-app
quarkus.http.auth.permission.authenticated.paths=/*
quarkus.http.auth.permission.authenticated.policy=authenticated
// Secure Resource Implementation
@Path(“/api/secure”)
@ApplicationScoped
public class SecureResource {
@GET
@RolesAllowed(“admin”)
@NoCache
public String getSensitiveData() {
return “Hardened Content”;
}
}