Fix Insecure API Management in Quarkus

Quarkus is optimized for the cloud, but its 'developer joy' defaults can be a security nightmare. Insecure API management in Quarkus typically involves exposed internal endpoints, missing Role-Based Access Control (RBAC), and leaking sensitive metadata through Swagger UI in production. If you aren't explicitly hardening your resource classes and application properties, you're providing an open invitation for unauthorized data exfiltration.

The Vulnerable Pattern

@Path("/api/v1/management")
public class ManagementResource {
    @Inject
    ConfigService configService;
@GET
@Path("/env-vars")
@Produces(MediaType.APPLICATION_JSON)
public Response getEnvVars() {
    // VULNERABILITY: No security constraints.
    // Any unauthenticated attacker can enumerate environment variables
    // and potentially find DB credentials or API keys.
    return Response.ok(configService.getSensitiveData()).build();
}
}

The Secure Implementation

To secure the API, we first implement the 'quarkus-oidc' or 'quarkus-security-jpa' extension. The '@Authenticated' annotation mandates a valid session or JWT. We then apply '@RolesAllowed("super-admin")' to enforce the Principle of Least Privilege, ensuring only users with high-level claims can access sensitive logic. Finally, we harden the infrastructure layer by disabling the Swagger UI in production to prevent API mapping/discovery and by restricting CORS origins to prevent Cross-Site Request Forgery and unauthorized cross-origin data reads.

@Path("/api/v1/management")
@Authenticated
public class ManagementResource {
    @Inject
    ConfigService configService;
@GET
@Path("/env-vars")
@RolesAllowed("super-admin")
@Produces(MediaType.APPLICATION_JSON)
public Response getEnvVars() {
    return Response.ok(configService.getSensitiveData()).build();
}
}
/* application.properties configuration */
// Disable Swagger/OpenAPI in production
quarkus.swagger-ui.always-include=false
// Enforce HTTPS
quarkus.http.ssl-port=8443
// Strict CORS policy
quarkus.http.cors=true
quarkus.http.cors.origins=https://trusted-domain.com