JWT Authorization skipped for POST with body

Describe the bug

The JWT authorization is skipped on an endpoint with a body.

    @POST
    @Path("/secured/bugged")
    @RolesAllowed({"User"})
    public Response helloSecured(MyRequest req) {
        System.out.println("You shouldn't be here");
        System.out.println(req);
        return Response.ok("{\"message\":\"you shouldn't be here\"}").build();
    }
    
    private static class MyRequest {
        public String name;
    }

$ curl -X POST -H "Content-Type: application/json" -i http://localhost:8080/hello/secured/bugged
HTTP/1.1 200 OK
Content-Type: application/json
content-length: 35

Without a body, it works correctly:

    @POST
    @Path("/secured/works")
    @RolesAllowed({"User"})
    public Response helloSecured() {
        return Response.ok().build();
    }

$ curl -X POST -i http://localhost:8080/hello/secured/works
HTTP/1.1 401 Unauthorized
www-authenticate: Bearer
content-length: 0

Expected behavior

It should return a 401 and doesn’t allows access to the method

Actual behavior

It returns a 200 and continues into the endpoint method

How to Reproduce?

$ git clone [e-mail]:Eldelshell/jwt-bug.git
$ cd jwt-bug
$ mvn clean install
$ mvn quarkus:dev

…in another terminal…

$ curl -X POST -H "Content-Type: application/json" -i http://localhost:8080/hello/secured/bugged

Output of uname -a or ver

x86_64 x86_64 x86_64 GNU/Linux

Output of java -version

openjdk version “11.0.7” 2020-04-14

GraalVM version (if different from Java)

No response

Quarkus version or git rev

2.4.2.Final

Build tool (ie. output of mvnw --version or gradlew --version)

Apache Maven 3.6.3

Additional information

When calling an endpoint without a body argument the logs show:

2021-11-19 14:13:14,990 DEBUG [io.sma.jwt.auth] (vert.x-eventloop-thread-12) SRJWT06000: tokenHeaderName = Authorization
2021-11-19 14:13:14,990 DEBUG [io.sma.jwt.auth] (vert.x-eventloop-thread-12) SRJWT06005: Authorization header was null
2021-11-19 14:13:15,011 DEBUG [io.qua.res.runtime] (executor-thread-0) Create constructor: public io.quarkus.resteasy.runtime.SecurityContextFilter()
2021-11-19 14:13:15,013 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) RESTEASY002315: PathInfo: /hello/secured/works

When calling the conflicting endpoint:

2021-11-19 14:13:53,516 DEBUG [io.sma.jwt.auth] (vert.x-eventloop-thread-0) SRJWT06000: tokenHeaderName = Authorization
2021-11-19 14:13:53,518 DEBUG [io.sma.jwt.auth] (vert.x-eventloop-thread-0) SRJWT06005: Authorization header was null
2021-11-19 14:13:53,522 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) RESTEASY002315: PathInfo: /hello/secured/bugged
2021-11-19 14:13:53,525 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) Interceptor Context: org.jboss.resteasy.core.interception.jaxrs.ServerReaderInterceptorContext,  Method : proceed
2021-11-19 14:13:53,528 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) MessageBodyReader: org.jboss.resteasy.core.providerfactory.SortedKey
2021-11-19 14:13:53,528 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) MessageBodyReader: org.jboss.resteasy.plugins.providers.jackson.ResteasyJackson2Provider
2021-11-19 14:13:53,529 DEBUG [org.jbo.res.res.i18n] (executor-thread-0) Provider : org.jboss.resteasy.plugins.providers.jackson.ResteasyJackson2Provider,  Method : readFrom
You shouldn't be here

[sberyozkin]

@Eldelshell Thanks for confirming, in meantime we’ll try to do something about preventing hard to diagnose sec problems when the private entities are used 😃

[Eldelshell]

Just tested this and you’re correct, changing to public made it work. Thanks!