{"record":{"id":"1eb95e980ef771ef","repo":"quarkusio/quarkus","slug":"only-one-of-the-annotations-annotations-can-be-1eb95e","errorCode":null,"errorMessage":"Only one of the '<annotations>' annotations can be applied on the '<method>' method","messagePattern":"Only one of the '<annotations>' annotations can be applied on the '<method>' method","errorType":"validation","errorClass":"RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java","lineNumber":903,"sourceCode":"                                }\n                            }\n                        }\n                    } else {\n                        MethodInfo mi = annotation.target().asMethod();\n\n                        if (hasClassLevelSecurity.test(mi.declaringClass())) {\n                            throw new RuntimeException(\n                                    (\"Security annotations '%s' cannot be applied on the '%s' method, \"\n                                            + \"please move the annotations to the class-level instead\").formatted(\n                                                    Arrays.toString(Arrays.stream(interceptorBinding.getAnnotationBindings())\n                                                            .toArray()),\n                                                    toTargetName(mi)));\n                        } else {\n                            // only allow to combine interceptor bindings on endpoints if we explicitly support it\n                            var appliedBindings = cache.computeIfAbsent(mi, a -> new ArrayList<>());\n                            if (appliedBindings.contains(interceptorBinding)) {\n                                if (!interceptorBinding.allowToRepeatThisInterceptorBinding()) {\n                                    throw new RuntimeException(\n                                            \"Only one of the '%s' annotations can be applied on the '%s' method\".formatted(\n                                                    Arrays.toString(interceptorBinding.getAnnotationBindings()),\n                                                    toTargetName(mi)));\n                                }\n                            } else {\n                                appliedBindings.add(interceptorBinding);\n                            }\n                        }\n\n                        addInterceptedEndpoint(mi, annotation, annotationBinding, bindingValueToInterceptedMethods,\n                                interceptorBinding);\n                    }\n                }\n                if (!bindingValueToInterceptedMethods.isEmpty()) {\n                    result.compute(annotationBinding, (key, existingMap) -> {\n                        if (existingMap == null) {\n                            return bindingValueToInterceptedMethods;\n                        } else {","sourceCodeStart":885,"sourceCodeEnd":921,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java#L885-L921","documentation":"A single endpoint method may only carry one of the mutually exclusive auth mechanism annotations (like @Basic, @Form), unless the specific interceptor binding explicitly allows repetition (e.g. @Tenant). Duplicates or conflicting mechanisms on one method cause a build failure naming the method.","triggerScenarios":"Annotating the same endpoint method with two auth mechanism annotations that don't allow repetition.","commonSituations":"Copy-pasting annotations onto a method that already had one; combining @Basic with @Form on one endpoint expecting fallback behavior; IDE auto-import adding an unintended annotation.","solutions":["Keep only one auth mechanism annotation on the method and remove the other","If repetition is legitimately required, use an annotation that allows it (e.g. @Tenant)","Use quarkus.http.auth.permission config for compound rules instead"],"exampleFix":"// before\n@GET\n@Basic\n@Form\npublic String get() { ... }\n// after\n@GET\n@Basic\npublic String get() { ... }","handlingStrategy":"validation","validationCode":"long count = Arrays.stream(method.getAnnotations())\n    .map(Annotation::annotationType)\n    .filter(t -> Set.of(Basic.class, Form.class, BearerAuth.class).contains(t))\n    .count();\nif (count > 1) throw new IllegalStateException(\"Only one auth mechanism annotation allowed on method\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["One mechanism annotation per endpoint method","Audit methods after copy-pasting endpoints","Use @Tenant (repeatable-allowed) when multi-dimension security is needed"],"tags":["quarkus","build-time","security","annotation"],"backgroundTag":"conflicting-security-annotations","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}