{"record":{"id":"4dc813cd97f5a447","repo":"quarkusio/quarkus","slug":"authentication-has-already-been-set","errorCode":null,"errorMessage":"Authentication has already been set","messagePattern":"Authentication has already been set","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":398,"sourceCode":"            this.authMechanism = null;\n            this.authorizationPolicy = null;\n            this.shared = false;\n            this.methods = null;\n            this.applyToJaxRs = false;\n        }\n\n        private void requireAuthenticationByDefault() {\n            // if someone selects authentication mechanism and doesn't configure\n            // authorization policy, it is reasonable to expect they require authentication\n            // similarly to what we do with @BasicAuthentication etc.\n            if (authorizationPolicy == null) {\n                authenticated();\n            }\n        }\n\n        private void validateAuthenticationNotSetYet() {\n            if (authMechanism != null) {\n                throw new IllegalArgumentException(\"Authentication has already been set\");\n            }\n        }\n\n        private void validateAuthorizationNotSetYet() {\n            if (authMechanism == null && authorizationPolicy != null) {\n                throw new IllegalArgumentException(\"Authorization has already been set\");\n            }\n        }\n\n        @Override\n        public HttpPermission basic() {\n            return authenticatedWith(BasicAuthentication.AUTH_MECHANISM_SCHEME);\n        }\n\n        @Override\n        public HttpPermission form() {\n            return authenticatedWith(FormAuthentication.AUTH_MECHANISM_SCHEME);\n        }","sourceCodeStart":380,"sourceCodeEnd":416,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L380-L416","documentation":"Thrown by HttpPermission's validateAuthenticationNotSetYet when the authentication mechanism is configured twice. A permission can define at most one authentication setup; once authMechanism is non-null, a second authentication assignment is rejected so the resulting policy is never ambiguous.","triggerScenarios":"Calling authenticatedWith(...) twice, or authenticated() followed by authenticatedWith(...)/basic()/form()/bearer()/mTLS()/webAuthn()/authorizationCodeFlow() on the same HttpPermission instance.","commonSituations":"Chaining .basic().bearer() hoping to allow multiple mechanisms; conditional code that calls different auth methods on the same permission object; copy-paste refactors of fluent chains.","solutions":["Call only one authentication method per HttpPermission; remove the redundant authenticated()/authenticatedWith(...) call.","If multiple mechanisms should be allowed, use authenticatedWith(Set<String> schemes) once with all schemes instead of repeated calls.","Split into separate permissions (separate paths() calls) if different paths need different mechanisms."],"exampleFix":"// before\nhttpSecurity.paths(\"/api/*\").basic().bearer(); // throws\n// after\nhttpSecurity.paths(\"/api/*\").authenticatedWith(Set.of(\"basic\", \"Bearer\"));","handlingStrategy":"validation","validationCode":"// ensure only one auth call: track in a local builder wrapper\nboolean authSet = false;\nif (authSet) throw new IllegalStateException(\"auth already configured\");","typeGuard":null,"tryCatchPattern":"try { perm.authenticatedWith(mech); } catch (IllegalArgumentException e) { if (!e.getMessage().contains(\"Authentication has already been set\")) throw e; }","preventionTips":["Call exactly one of authenticated()/authenticatedWith(...)/basic()/form()/bearer()/mTLS()/webAuthn() per permission.","Use authenticatedWith(Set<String>) to allow multiple schemes in one call.","Decide the authentication mechanism before building the chain."],"tags":["quarkus","http-security","authentication","fluent-builder"],"backgroundTag":"builder-state-already-set","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}