quarkus-security

Topics in the source

• Quarkus Security Review
• When to Activate
• Authentication
• JWT Authentication
• Custom Authentication Filter
• Authorization
• Role-Based Access Control
• Programmatic Security

Best practices for securing Quarkus applications with authentication, authorization, and input validation. Adding authentication (JWT, OIDC, Basic Auth) Implementing authorization with @RolesAllowed or SecurityIdentity Validating user input (Bean Validation, custom validators) Configuring CORS or security headers Managing secrets (Vault, environment variables, config sources) Adding rate limiting or brute-force protection Scanning dependencies for CVEs Working with MicroProfile JWT or SmallRye JWT Configuration (application.properties): Security Note: Never use X-Forwarded-For directly — clients can spoof it. Use the actual remote address from the servlet request, or an authenticated identity (API key, JWT subject) when available. Always use HTTPS in production Enable JWT or OIDC for stateless authentication Use @RolesAllowed for declarative authorization Validate all input with Bean Validation Hash passwords with BCrypt (never plaintext) Store secrets in Vault or environment variables Use parameterized queries to prevent SQL injection Add security headers to all responses Implement rate limiting for public endpoints Audit sensitive operations Keep dependencies updated and scan for

This is an excerpt. Refer to the complete source and its current requirements.