Quarkus Security
Apply Quarkus-specific auth, JWT/OIDC, RBAC, validation, CORS, secrets, and dependency security patterns while hardening a Java API before production.
Overview
Quarkus Security is an agent skill for the Ship phase that guides authentication, authorization, JWT/OIDC, RBAC, input validation, secrets, and dependency security for Quarkus applications.
Install
npx skills add https://github.com/affaan-m/everything-claude-code --skill quarkus-securityWhat is this skill?
- JWT and OIDC patterns with @Authenticated, JsonWebToken, and SecurityIdentity examples
- Authorization with @RolesAllowed and MicroProfile / SmallRye JWT configuration snippets
- Input validation, CORS, security headers, rate limiting, and brute-force protection guidance
- Secrets via Vault, env vars, and config sources plus dependency CVE scanning triggers
Adoption & trust: 1.1k installs on skills.sh; 210k GitHub stars; 3/3 security scanners passed (skills.sh audits).
What problem does it solve?
Your Quarkus API needs production-grade auth and hardening but generic security advice misses MicroProfile JWT, OIDC, and Quarkus config conventions.
Who is it for?
Indie developers shipping Quarkus or Java microservices who are adding JWT/OIDC, roles, or secrets management under time pressure.
Skip if: Non-JVM stacks, greenfield projects with no HTTP API, or teams that only need org-wide compliance frameworks without Quarkus code changes.
When should I use this skill?
Adding authentication, implementing authorization, validating input, configuring CORS or security headers, managing secrets, rate limiting, CVE scanning, or working with MicroProfile JWT / SmallRye JWT on Quarkus.
What do I get? / Deliverables
You implement aligned Quarkus security patterns—protected resources, issuer config, validation, and secrets—ready for review before deploy.
- Secured resource classes, application.properties security config, validation and headers guidance applied in codebase
Recommended Skills
Journey fit
How it compares
Quarkus-focused secure coding reference, not a runtime vulnerability scanner or generic OWASP checklist skill.
Common Questions / FAQ
Who is quarkus-security for?
Builders using Quarkus who need practical Java and configuration patterns for authentication, authorization, and common appsec controls.
When should I use quarkus-security?
Use it in Ship/security when adding JWT or OIDC, @RolesAllowed, input validation, CORS, Vault or env secrets, rate limits, or scanning dependencies for CVEs on a Quarkus service.
Is quarkus-security safe to install?
It provides static best-practice guidance; confirm repo trust and review the Security Audits panel on this Prism page before install.
SKILL.md
READMESKILL.md - Quarkus Security
# Quarkus Security Review Best practices for securing Quarkus applications with authentication, authorization, and input validation. ## When to Activate - Adding authentication (JWT, OIDC, Basic Auth) - Implementing authorization with @RolesAllowed or SecurityIdentity - Validating user input (Bean Validation, custom validators) - Configuring CORS or security headers - Managing secrets (Vault, environment variables, config sources) - Adding rate limiting or brute-force protection - Scanning dependencies for CVEs - Working with MicroProfile JWT or SmallRye JWT ## Authentication ### JWT Authentication ```java // Resource protected with JWT @Path("/api/protected") @Authenticated public class ProtectedResource { @Inject JsonWebToken jwt; @Inject SecurityIdentity securityIdentity; @GET public Response getData() { String username = jwt.getName(); Set<String> roles = jwt.getGroups(); return Response.ok(Map.of( "username", username, "roles", roles, "principal", securityIdentity.getPrincipal().getName() )).build(); } } ``` Configuration (application.properties): ```properties mp.jwt.verify.publickey.location=publicKey.pem mp.jwt.verify.issuer=https://auth.example.com # OIDC quarkus.oidc.auth-server-url=https://auth.example.com/realms/myrealm quarkus.oidc.client-id=backend-service quarkus.oidc.credentials.secret=${OIDC_SECRET} ``` ### Custom Authentication Filter ```java @Provider @Priority(Priorities.AUTHENTICATION) public class CustomAuthFilter implements ContainerRequestFilter { @Inject SecurityIdentity identity; @Override public void filter(ContainerRequestContext requestContext) { String authHeader = requestContext.getHeaderString(HttpHeaders.AUTHORIZATION); // Reject immediately if header is absent or malformed if (authHeader == null || !authHeader.startsWith("Bearer ")) { requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build()); return; } String token = authHeader.substring(7); if (!validateToken(token)) { requestContext.abortWith(Response.status(Response.Status.UNAUTHORIZED).build()); } } private boolean validateToken(String token) { // Token validation logic return true; } } ``` ## Authorization ### Role-Based Access Control ```java @Path("/api/admin") @RolesAllowed("ADMIN") public class AdminResource { @GET @Path("/users") public List<UserDto> listUsers() { return userService.findAll(); } @DELETE @Path("/users/{id}") @RolesAllowed({"ADMIN", "SUPER_ADMIN"}) public Response deleteUser(@PathParam("id") Long id) { userService.delete(id); return Response.noContent().build(); } } @Path("/api/users") public class UserResource { @Inject SecurityIdentity securityIdentity; @GET @Path("/{id}") @RolesAllowed("USER") public Response getUser(@PathParam("id") Long id) { // Check ownership if (!securityIdentity.hasRole("ADMIN") && !isOwner(id, securityIdentity.getPrincipal().getName())) { return Response.status(Response.Status.FORBIDDEN).build(); } return Response.ok(userService.findById(id)).build(); } private boolean isOwner(Long userId, String username) { return userService.isOwner(userId, username); } } ``` ### Programmatic Security ```java @ApplicationScoped public class SecurityService { @Inject SecurityIdentity securityIdentity; public boolean canAccessResource(Long resourceId) { if (securityIdentity.isAnonymous()) { return false; } if (securityIdentity.hasRole("ADMIN")) { return true; } String userId = securityIdentity.getPrincipal().getName(); return resourceRepository.isOwner(resourceId, userId); } } ``` ## Input Validation ###