Chapter 1. Quarkus Security overview

The Quarkus Security framework provides built-in security authentication mechanisms for Basic, Form-based, and mutual TLS (mTLS) authentication. You can also use other well-known authentication mechanisms, such as OpenID Connect (OIDC). Authentication mechanisms depend on Identity providers to verify the authentication credentials and map them to a SecurityIdentity instance with the username, roles, original authentication credentials, and other attributes.

Red Hat build of Quarkus also includes built-in security to allow for role-based access control (RBAC) based on the common security annotations @RolesAllowed, @DenyAll, @PermitAll on REST endpoints, and Contexts and Dependency Injection (CDI) beans. For more information, see the Quarkus Authorization of web endpoints guide.

Quarkus Security also supports the following features:

Quarkus Security is also highly customizable. For more information, see the Quarkus Security tips and tricks guide.

To get started with security in Quarkus, consider securing your Quarkus application endpoints with the built-in Quarkus Basic authentication and the Jakarta Persistence identity provider and enabling role-based access control.

Complete the steps in the Getting started with Security by using Basic authentication and Jakarta Persistence tutorial.

After successfully securing your Quarkus application with Basic authentication, you can increase the security further by adding more advanced authentication mechanisms, for example, the Quarkus OpenID Connect (OIDC) authorization code flow mechanism guide.

For guidance on testing Quarkus Security features and ensuring that your Quarkus applications are securely protected, see the Security testing guide.

Quarkus provides support to store secrets in environment properties. For more information, see the Quarkus store secrets in an environment properties file guide.

Most Quarkus tags get reported in the US National Vulnerability Database (NVD). For information about security vulnerabilities, see the Security vulnerability detection and reporting in Quarkus guide.