What does this skill do?

The Quarkus Security Skill provides a comprehensive guide to best practices for securing Quarkus applications, covering authentication with JWT/OIDC, declarative authorization with roles, strict input validation, and SQL injection prevention. It securely manages secrets using environment variables or HashiCorp Vault and implements security headers, rate limiting, and protection against CSRF/XSS.

JWT and OIDC Authentication
Protect resources with @Authenticated and inject a JsonWebToken to access the user's claims in your endpoints.
RBAC Authorization
Configure declarative authorization using @RolesAllowed at the class or method level to restrict access based on roles.
Ticket Validation
Apply Bean Validation using @NotBlank, @Email, and @Size on your DTOs, and annotate the endpoints with @Valid.
Secret Management
Avoid hard-coding secrets in `application.properties` by using environment variables or integrating with HashiCorp Vault.

Usage examples

🔑 Secure endpoints with JWT
I need to secure the /api/admin endpoint of my Quarkus application so that only users with the ADMIN role can access it using JWT.
✅ Validate registration DTO
Create a user registration DTO with field validation (name, email, password—at least 8 characters) and hash the password using BCrypt.
🔒 Configure secrets and CORS
Configure my Quarkus `application.properties` file to use environment variables for OIDC and database secrets, and add CORS for my domain.
🛡️ HTTP Hardening
Add CSP, HSTS, and X-Frame-Options security headers to my Quarkus application and configure rate limiting on public endpoints.

Features

JWT/OIDC Authentication Integration with quarkus-oidc to secure resources using @Authenticated and access token claims.
Declarative RBAC Authorization Role-based access control using @RolesAllowed and SecurityIdentity at the class or method level.
Validation with Bean Validation @NotBlank, @Email, and @Size annotations on DTOs and endpoints marked with @Valid for strict input validation.
SQL Injection Prevention Parameterized queries using Panache and JPA to prevent database injection vulnerabilities.
HTTP Hardening and Secret Management Security headers (CSP, HSTS, X-Frame-Options), rate limiting, and secrets via environment variables or HashiCorp Vault.

Frequently asked questions

No. This skill is a best-practices guide that applies directly to your Quarkus code. You just need to have your Quarkus project set up with the appropriate security dependencies (quarkus-oidc, quarkus-security, etc.).
Yes. The practices and annotations described (SecurityIdentity, @RolesAllowed, JsonWebToken, Bean Validation) are compatible with Quarkus 3.x and later.
It recommends avoiding hard-coded secrets in application.properties and using environment variables (${ENV_VAR}) or integration with HashiCorp Vault for secure management.
Yes. Bean Validation annotations are configurable, and you can create custom validators based on your application's needs.
Security in Quarkus — Hardening Java Microservices with Claude AI

¿Prefieres escuchar el contenido? Genera la narración de audio con un clic.