Best way to intercept all the REST calls and apply authentication based on method annotation

[dloiacono]

Hi there,
Is there a way to have one interceptor or filter that can give information about the method to check annotations on it and apply different behaviors?

[sberyozkin]

@dloiacono Hi, I think one option is to use JAX-RS ContainerRequestFilter with the injected RequestInfo

[dloiacono]

but I don't see a way to get info of the class's method to be called in order to check annotations.
I was not referring the HTTP method.
I'm trying to implement this at build time....

[sberyozkin]

CC @geoand

[geoand]

Let's please clarify the requirements.

At a basic level, I assume what you are after is intercepting all calls made via the REST Client (quarkus-rest-client artifact) and checking whether or not they originated from a JAX-RS / Jakarta REST Resource that has certain characteristics, correct?

[dloiacono]

Hi @geoand,
I'm talking about the server side.
The requirement is to protect every REST API with an authentication mechanism.
The current Smallray implementation checks the Authorization Header's assistance and applies the checks.
But if the header is not there, then nothing happened.
I want to change this behavior and apply the check on every request and if the header is not present then raise an exception.
I want to have also the possibility to mark an API as public so no authorization checks are needed.
The only way I found to implement these requirements is at build time.
Is there another way?

[geoand]

In that case, what @sberyozkin proposes is the way to go:

Either use ContainerRequestFilter with a @Context ResourceInfo resourceInfo field. or use @ServerRequestFilter which gives you immediate access to ResourceInfo

[dloiacono]

The only way I found to implement this behavior is at build time.
Defining a BuildStep and checking for the method definition discovering applied annotations and then create an AdditionalSecurityCheckBuildItem

[dloiacono]

but in the @sberyozkin approach I can't access to the class's method definition to check annotations. Or ?

[geoand]

You absolutely can, that's what ResourceInfo gives you :)

[Serkan80]

Can’t you enforce it with:

quarkus.http.auth.permission.myapp.paths=/my-path/*
quarkus.http.auth.permission.myapp.policy=authenticated
quarkus.http.auth.permission.myapp.auth-mechanism=bearer

it should give a 401 when you send a request with an empty header.