{"record":{"id":"4e458ecd389d54ad","repo":"quarkusio/quarkus","slug":"method-s-of-class-s-is-annotated-with-multiple-s-4e458e","errorCode":null,"errorMessage":"Method %s of class %s is annotated with multiple security annotations","messagePattern":"Method (.+?) of class (.+?) is annotated with multiple security annotations","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java","lineNumber":1544,"sourceCode":"                    } else {\n                        throw new IllegalStateException(\n                                \"Class \" + target.asClass() + \" is annotated with multiple security annotations \"\n                                        + instance.name()\n                                        + \" and \" + existingClassInstance.name());\n                    }\n                }\n\n            }\n        }\n\n        private void gatherMethodSecurityAnnotations() {\n            // make sure we process annotations on methods first\n            for (AnnotationInstance instance : annotationInstances) {\n                AnnotationTarget target = instance.target();\n                if (target.kind() == AnnotationTarget.Kind.METHOD) {\n                    MethodInfo methodInfo = target.asMethod();\n                    if (alreadyCheckedMethods.containsKey(methodInfo) || hasAdditionalSecurityAnnotation.test(methodInfo)) {\n                        throw new IllegalStateException(\n                                \"Method \" + methodInfo.name() + \" of class \" + methodInfo.declaringClass()\n                                        + \" is annotated with multiple security annotations\");\n                    }\n                    alreadyCheckedMethods.put(methodInfo, instance);\n                    putResult.accept(methodInfo, instance);\n                }\n            }\n        }\n    }\n\n    private static final class AuthorizationTypeToSecurityAnnotationsBuildItem extends SimpleBuildItem {\n\n        private final Map<AuthorizationType, Set<DotName>> result;\n\n        private AuthorizationTypeToSecurityAnnotationsBuildItem(\n                Map<AuthorizationType, Set<DotName>> authorizationTypeToSecurityAnnotations) {\n            this.result = Collections.unmodifiableMap(authorizationTypeToSecurityAnnotations);\n        }","sourceCodeStart":1526,"sourceCodeEnd":1562,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java#L1526-L1562","documentation":"A single method carries more than one security annotation (or is both annotated and registered as an additional secured method). Quarkus cannot merge arbitrary security checks for the same method, so application build fails.","triggerScenarios":"Method annotated with e.g. @RolesAllowed and @PermissionsAllowed simultaneously; or a method already annotated is also listed in additional secured methods config; or meta-annotations expand to two security annotations on one method.","commonSituations":"Migrating from @RolesAllowed to @PermissionsAllowed and leaving both; combining annotation-driven security with quarkus.security.additional-secured-methods for the same method; custom stereotype annotations that each carry a security annotation.","solutions":["Keep exactly one security annotation on the method; combine constraints in a single annotation (e.g. @PermissionsAllowed(\"admin\", \"read\") or @RolesAllowed with multiple roles).","Remove the method from additional secured methods config if it is directly annotated.","If using custom stereotype/meta-annotations, ensure only one of them carries a Quarkus security annotation."],"exampleFix":"// before\n@RolesAllowed(\"admin\")\n@PermissionsAllowed(\"delete:user\")\npublic void deleteUser() { ... }\n// after\n@PermissionsAllowed(value = \"delete:user\", rolesAllowed = \"admin\")\npublic void deleteUser() { ... }","handlingStrategy":"validation","validationCode":"long n = Stream.of(RolesAllowed.class, PermissionsAllowed.class, Authenticated.class, DenyAll.class)\n    .filter(a -> method.isAnnotationPresent(a)).count();\nif (n > 1) throw new IllegalStateException(\"multiple security annotations on \" + method);","typeGuard":null,"tryCatchPattern":null,"preventionTips":["One security annotation per method","Do not list annotated methods in additional secured methods config","Audit stereotype annotations for nested security annotations"],"tags":["quarkus","security","build-time","duplicate-annotation"],"backgroundTag":"conflicting-security-annotations","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}