{"record":{"id":"cbffe69272394a6f","repo":"quarkusio/quarkus","slug":"class-s-is-annotated-with-s-and-s-securit","errorCode":null,"errorMessage":"Class '%s' is annotated with '%s' and '%s' security annotations,\n                                    however security annotations cannot be combined.","messagePattern":"Class '(.+?)' is annotated with '(.+?)' and '(.+?)' security annotations,\n                                    however security annotations cannot be combined\\.","errorType":"exception","errorClass":"java.lang.RuntimeException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java","lineNumber":1111,"sourceCode":"        permitAllGatherer.gatherClassSecurityAnnotations();\n        authenticatedGatherer.gatherClassSecurityAnnotations();\n        denyAllGatherer.gatherClassSecurityAnnotations();\n        rolesAllowedGatherer.gatherClassSecurityAnnotations();\n\n        // we already validated that annotation target doesn't have more than one security check annotation\n        // now validate that the same annotation target doesn't have both security check and authorization policy annotation\n        securityTransformer.getSecurityAnnotationNames(AUTHORIZATION_POLICY)\n                .forEach(additionalSecAnnName -> index\n                        .getAnnotations(additionalSecAnnName)\n                        .stream()\n                        .filter(ai -> ai.target().kind() == AnnotationTarget.Kind.CLASS)\n                        .map(ai -> ai.target().asClass())\n                        .filter(ai -> securityTransformer.hasSecurityAnnotation(ai, SECURITY_CHECK))\n                        .findFirst()\n                        .ifPresent(ci -> {\n                            var securityAnnotation = securityTransformer.findFirstSecurityAnnotation(ci, SECURITY_CHECK)\n                                    .get().name();\n                            throw new RuntimeException(\"\"\"\n                                    Class '%s' is annotated with '%s' and '%s' security annotations,\n                                    however security annotations cannot be combined.\n                                    \"\"\".formatted(ci.name(), additionalSecAnnName, securityAnnotation));\n                        }));\n\n        /*\n         * Handle additional secured methods by adding the denyAll/rolesAllowed check to all public non-static methods\n         * that don't have same security annotations\n         */\n        for (AdditionalSecured additionalSecuredMethod : additionalSecuredMethods) {\n            if (!isPublicNonStaticNonConstructor(additionalSecuredMethod.methodInfo)) {\n                continue;\n            }\n            if (hasAdditionalSecurityAnnotations.test(additionalSecuredMethod.methodInfo)) {\n                continue;\n            }\n            AnnotationInstance alreadyExistingInstance = methodToInstanceCollector.get(additionalSecuredMethod.methodInfo);\n            if (additionalSecuredMethod.rolesAllowed.isPresent()) {","sourceCodeStart":1093,"sourceCodeEnd":1129,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java#L1093-L1129","documentation":"A class annotated with a custom/additional security annotation (registered via AdditionalSecurityAnnotationBuildItem) cannot also carry a standard Quarkus security annotation such as @RolesAllowed/@Authenticated on the same target — security annotations cannot be combined. The build fails naming both annotations.","triggerScenarios":"A class carries both a registered custom security annotation and a standard security annotation (e.g. @MyCustomAuth + @RolesAllowed) at the class level.","commonSituations":"Introducing a custom security annotation while legacy @RolesAllowed remains on the same class; library classes annotated with standard annotations being re-annotated with a company-specific annotation during a migration.","solutions":["Remove one of the two annotations from the class — either the custom annotation or the standard security annotation.","If the custom annotation should imply the standard check, model that in the annotation's own build step instead of combining annotations.","Move the standard annotation to specific methods rather than combining them at class level, if the framework supports method-level separation."],"exampleFix":"// before\n@RolesAllowed(\"admin\")\n@CustomSecurity\npublic class AdminResource { ... }\n\n// after\n@CustomSecurity\npublic class AdminResource { ... } // handle roles inside the custom check","handlingStrategy":"validation","validationCode":"// fail fast if both a custom and a standard security annotation are present on a class\nif (AdminResource.class.isAnnotationPresent(RolesAllowed.class) && AdminResource.class.isAnnotationPresent(CustomSecurity.class)) throw new IllegalStateException(\"security annotations cannot be combined\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Pick one security annotation scheme per class","During custom-annotation migrations, sweep and remove legacy standard annotations","Add an ArchUnit-style test enforcing the single-annotation rule"],"tags":["quarkus","security","annotations","build-time"],"backgroundTag":"conflicting-security-annotations","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}