Swagger UI does not send Authorization header when using @AuthorizationPolicy on REST resource class instead of @Authenticated #51607
Description
Describe the bug
I've annotated my REST resource classes with @AuthorizationPolicy.
Example:
@Path(/my-resource)
@AuthorizationPolicy(name = DefaultHttpSecurityPolicy.NAME)
public class MyResource {
...
}
I've also enabled Basic Authentication (but I have the same problem with OIDC token authentication) :
quarkus.http.auth.basic=true
The problem is that once authenticated, the Swagger UI does not send the 'Authorization' header on requests.
It seems indeed the OpenAPI security attribute is only added on methods if I annotate my resource classes with @Authenticated.
But Quarkus does not allow to use both the @Authenticated and the @AuthorizationPolicy annotations :
Class 'MyResource' is annotated with 'io.quarkus.vertx.http.security.AuthorizationPolicy' and 'io.quarkus.security.Authenticated' security annotations,
however security annotations cannot be combined.
So it is just impossible to have a working SwaggerUI when using @AuthorizationPolicy annotation
Expected behavior
Using @AuthorizationPolicy on a resource class, should automatically mark its methods as secured in OpenAPI schema so that authentication through SwaggerUI can work.
Actual behavior
Using @AuthorizationPolicy on a resource class, does not automatically mark its methods as secured in OpenAPI schema
How to Reproduce?
No response
Output of uname -a or ver
No response
Output of java -version
No response
Quarkus version or git rev
3.27.1
Build tool (ie. output of mvnw --version or gradlew --version)
No response
Additional information
No response