Is there a way to exclude some paths from the Quarkus OIDC verification

Question

I'm using the quarkus-oidc component to enforce the JWT token validation in calls to a microservice.

The point is there are some paths (/api/public/*) that can be invoked publicly (without needing an Authorization: Bearer JWT).

Is there a way to exclude paths from the token verification?

Answer 1

Based on the documentation you can disable authorization for select paths like this:

quarkus.http.auth.permission.permit1.paths=/api/public/*
quarkus.http.auth.permission.permit1.methods=GET,HEAD
quarkus.http.auth.permission.permit1.policy=permit