{"record":{"id":"21d8353366b8d985","repo":"quarkusio/quarkus","slug":"an-invalid-security-annotation-combination-was-det","errorCode":null,"errorMessage":"An invalid security annotation combination was detected: Found @<instance> and @<securityAnnotation> on class <class>","messagePattern":"An invalid security annotation combination was detected: Found @<instance> and @<securityAnnotation> on class <class>","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java","lineNumber":179,"sourceCode":"        List<AnnotationInstance> annotations = methodInfo.annotations();\n        for (AnnotationInstance instance : annotations) {\n            if (toCheck.contains(instance.name())) {\n                return true;\n            }\n        }\n        return false;\n    }\n\n    //Validates that there is no @Secured with the standard security annotations at class level\n    private void checksStandardSecurity(AnnotationInstance instance, ClassInfo classInfo,\n            SecurityTransformer securityTransformer) {\n        if (securityTransformer.hasSecurityAnnotation(classInfo)) {\n            Optional<AnnotationInstance> firstStandardSecurityAnnotation = securityTransformer\n                    .findFirstSecurityAnnotation(classInfo);\n            if (firstStandardSecurityAnnotation.isPresent()) {\n                String securityAnnotationName = securityTransformer.findFirstSecurityAnnotation(classInfo).get().name()\n                        .withoutPackagePrefix();\n                throw new IllegalArgumentException(\"An invalid security annotation combination was detected: Found @\"\n                        + instance.name().withoutPackagePrefix() + \" and @\" + securityAnnotationName + \" on class \"\n                        + classInfo.simpleName());\n            }\n        }\n    }\n\n    //Validates that there is no @Secured with the standard security annotations at method level\n    private void checksStandardSecurity(AnnotationInstance instance, MethodInfo methodInfo,\n            SecurityTransformer securityTransformer) {\n        if (securityTransformer.hasSecurityAnnotation(methodInfo)) {\n            Optional<AnnotationInstance> firstStandardSecurityAnnotation = securityTransformer\n                    .findFirstSecurityAnnotation(methodInfo);\n            if (firstStandardSecurityAnnotation.isPresent()) {\n                String securityAnnotationName = securityTransformer.findFirstSecurityAnnotation(methodInfo).get()\n                        .name()\n                        .withoutPackagePrefix();\n                throw new IllegalArgumentException(\"An invalid security annotation combination was detected: Found \"\n                        + instance.name().withoutPackagePrefix() + \" and \" + securityAnnotationName + \" on method \"","sourceCodeStart":161,"sourceCodeEnd":197,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java#L161-L197","documentation":"Quarkus forbids mixing a Spring Security annotation (@Secured or @PreAuthorize) with one of Quarkus's own standard security annotations (@RolesAllowed, @Authenticated, @PermitAll, @DenyAll) on the same class. checksStandardSecurity detects the combination and throws this IllegalArgumentException at build time because the two security models cannot be reconciled.","triggerScenarios":"A class carries both a Spring Security annotation (e.g. @Secured(\"ROLE_ADMIN\")) and a standard annotation (e.g. @RolesAllowed(\"admin\")); detected while processing the class-level annotation.","commonSituations":"Incremental migration from @RolesAllowed to Spring Security annotations (or vice versa) leaving both on a class; a base class or imported controller that already has the other annotation.","solutions":["Remove one of the annotations — keep either the Spring Security annotation or the standard one on the class","If class-level @RolesAllowed is desired, drop @Secured/@PreAuthorize from the class and use it consistently project-wide","Move the Spring Security expression to the method level and keep the standard annotation only where appropriate, but never both on the same target"],"exampleFix":"// before\n@Secured(\"ROLE_ADMIN\")\n@RolesAllowed(\"admin\")\npublic class AdminResource { }\n\n// after\n@RolesAllowed(\"admin\")\npublic class AdminResource { }","handlingStrategy":"validation","validationCode":"// project convention check: a class must not mix annotation families\nboolean hasSpring = AdminResource.class.isAnnotationPresent(Secured.class);\nboolean hasStandard = AdminResource.class.isAnnotationPresent(RolesAllowed.class);\nif (hasSpring && hasStandard) throw new IllegalStateException(\"Mixed security annotations on class\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Choose one security annotation style per class","Search for dual annotations during migrations between @RolesAllowed and @Secured","Document the chosen annotation style in team conventions"],"tags":["spring-security","build-time","annotation-conflict","roles-allowed"],"backgroundTag":"conflicting-security-annotations","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}