{"record":{"id":"e764a55be6753a7f","repo":"quarkusio/quarkus","slug":"method-s-s-should-not-have-been-added-as-an-addi","errorCode":null,"errorMessage":"Method %s#%s should not have been added as an additional secured method as it's already annotated with @RolesAllowed.","messagePattern":"Method (.+?)#(.+?) should not have been added as an additional secured method as it's already annotated with @RolesAllowed\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java","lineNumber":1135,"sourceCode":"        /*\n         * Handle additional secured methods by adding the denyAll/rolesAllowed check to all public non-static methods\n         * that don't have same security annotations\n         */\n        for (AdditionalSecured additionalSecuredMethod : additionalSecuredMethods) {\n            if (!isPublicNonStaticNonConstructor(additionalSecuredMethod.methodInfo)) {\n                continue;\n            }\n            if (hasAdditionalSecurityAnnotations.test(additionalSecuredMethod.methodInfo)) {\n                continue;\n            }\n            AnnotationInstance alreadyExistingInstance = methodToInstanceCollector.get(additionalSecuredMethod.methodInfo);\n            if (additionalSecuredMethod.rolesAllowed.isPresent()) {\n                if (alreadyExistingInstance == null) {\n                    methodToRoles.put(additionalSecuredMethod.methodInfo,\n                            additionalSecuredMethod.rolesAllowed.get().toArray(String[]::new));\n                } else if (alreadyHasAnnotation(alreadyExistingInstance, ROLES_ALLOWED)) {\n                    // we should not try to add second @RolesAllowed\n                    throw new IllegalStateException(\"Method \" + additionalSecuredMethod.methodInfo.declaringClass() + \"#\"\n                            + additionalSecuredMethod.methodInfo.name() + \" should not have been added as an additional \"\n                            + \"secured method as it's already annotated with @RolesAllowed.\");\n                }\n            } else {\n                if (alreadyExistingInstance == null) {\n                    result.put(additionalSecuredMethod.methodInfo, recorder.denyAll());\n                } else if (alreadyHasAnnotation(alreadyExistingInstance, DENY_ALL)) {\n                    // we should not try to add second @DenyAll\n                    throw new IllegalStateException(\"Method \" + additionalSecuredMethod.methodInfo.declaringClass() + \"#\"\n                            + additionalSecuredMethod.methodInfo.name() + \" should not have been added as an additional \"\n                            + \"secured method as it's already annotated with @DenyAll.\");\n                }\n            }\n        }\n\n        // create roles allowed security checks\n        // we create only one security check for each role set\n        Map<Set<String>, SecurityCheck> cache = new HashMap<>();","sourceCodeStart":1117,"sourceCodeEnd":1153,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java#L1117-L1153","documentation":"When an additional secured method (added via AdditionalSecuredBuildItem) targets a method already annotated with @RolesAllowed, Quarkus detects it would have to apply a second @RolesAllowed annotation, which is illegal, and aborts the build. This is an internal consistency check indicating a producer added a redundant/contradictory additional secured method.","triggerScenarios":"A custom extension produces an AdditionalSecuredBuildItem for a method that already has @RolesAllowed, while that method also already has a security annotation instance in the build (alreadyExistingInstance with ROLES_ALLOWED).","commonSituations":"Custom extension automatically securing endpoints that are already secured by @RolesAllowed in application code; misconfigured additionalSecured rolesAllowed on an annotated legacy class.","solutions":["Do not produce an AdditionalSecuredBuildItem for methods already annotated with @RolesAllowed; filter such methods in the producing build step.","Remove the redundant @RolesAllowed from the method if the additional secured item should own the security config.","If roles should merge, handle merging logic in your own build step before producing the item, instead of emitting a duplicate."],"exampleFix":"// before\n// extension produces additional secured item for method annotated @RolesAllowed(\"admin\")\n\n// after\nif (methodInfo.hasAnnotation(ROLES_ALLOWED)) return; // skip already-secured methods in your build step","handlingStrategy":"validation","validationCode":"// in your build step, skip methods already carrying @RolesAllowed\nif (methodInfo.hasAnnotation(\"jakarta.annotation.security.RolesAllowed\")) return null;","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Check for existing @RolesAllowed before emitting AdditionalSecuredBuildItem","Centralize automatic securing logic so duplicates cannot arise","Document which classes/methods your extension secures automatically"],"tags":["quarkus","security","rolesallowed","build-item","duplicate"],"backgroundTag":"conflicting-security-annotations","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}