difficult to require authentication for all requests by default

[vsTianhao]

if

quarkus.http.auth.permission.default.paths=/*
quarkus.http.auth.permission.default.policy=authenticated

All security annotations (like jakarta.annotation.security.PermitAll) become meaningless.

I only have two options:

1. I don't write anything security-related in the configuration file.
2. I write hundreds of extremely long paths in quarkus.http.auth.permission.public.paths that cannot be shortened using wildcards.

[sberyozkin]

@vsTianhao Let me move to the Quarkus discussion

[sberyozkin]

@vsTianhao Thanks, so you'd like to have all of your JAX-RS resources authenticated but have a few public URLs, and the overall resources is rather complex, right ?

I don't write anything security-related in the configuration file.

This is certainly an option, how many top level JAX-RS endpoints do you have ? You can have class level @Authenticated added to those endpoints, if it is not a large number of endpoints then it should be quite manageable; and adding @PermitAll where needed as you'd like to do. Can that work for you ?

I write hundreds of extremely long paths in quarkus.http.auth.permission.public.paths that cannot be shortened using wildcards.

Can you clarify this point please ?

Are secured URLs overlapping with public ones ?
For example, do you have a URL likes /a/b/c and /a/b/f, where /a, /a/b, '/a/b/f' are secure but /a/b/c is public ?

[vsTianhao]

yes, a lot of paths are irregular, and I now use apt to check that all resources must carry security annotations @Authenticated / @PermitAll

[vsTianhao]

Now this is actually reasonable, marking each situation more clearly, but I feel that spring security is smarter, it can have both permissions by default and no permissions by default

[sberyozkin]

Thanks @vsTianhao

The following setup will give it to you

quarkus.http.auth.permission.default.paths=/*
quarkus.http.auth.permission.default.policy=authenticated

quarkus.http.auth.permission.permit.paths=/a/b/c
quarkus.http.auth.permission.permit.policy=permit

It is true that a global policy setup at the HTTP policy configuration level, such as

quarkus.http.auth.permission.default.paths=/*
quarkus.http.auth.permission.default.policy=authenticated

can not be currently overridden on a path specific basis with an annotation such as @PermitAll.

That said, it is not obvious to me, that using hundreds (just quoting the amount you referred to in the description) of @PermitAll to override the global policy is less brittle or error prone, compared to listing paths in the permit HTTP policy.

At least in the latter case you can see all of them listed in one place, with the @PermitAll annotations scattered over multiple JAX-RS resources/sub-resources it is not so easy to see the whole picture.

FYI, you can also do multiple wildcards as in /a/b/*/c/*/1, can that help ?

Thanks

[vsTianhao]

Wildcards are not very useful, permissionless resources grow with development progress, and the number of REST resources is very large

If I write too much in the config file, 1 is that change/merge conflicts are frequent, 2 is that the definition of the entrance is scattered, which is not good

If they are all written in annotation, although I don't know which ones have permissions and which don't at the moment, it's actually not a hassle to do the scanner manually, and it doesn't distract the focus during development

[sberyozkin]

@vsTianhao Can you please check what happens if you do

quarkus.http.auth.permission.default.paths=/*
quarkus.http.auth.permission.default.policy=authenticated
quarkus.http.auth.permission.default.applies-to=jaxrs

Can it make @PermitAll effective ?