{"record":{"id":"e8fddfea76e914a5","repo":"quarkusio/quarkus","slug":"quarkus-does-not-support-the-annotation-annotat","errorCode":null,"errorMessage":"Quarkus does not support the @<annotation> annotation, found on <location>. Only @Secured and @PreAuthorize are supported. See https://quarkus.io/guides/spring-security#supported-spring-security-annotations","messagePattern":"Quarkus does not support the @<annotation> annotation, found on <location>\\. Only @Secured and @PreAuthorize are supported\\. See https://quarkus\\.io/guides/spring-security#supported-spring-security-annotations","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java","lineNumber":86,"sourceCode":"        return new FeatureBuildItem(Feature.SPRING_SECURITY);\n    }\n\n    @BuildStep\n    @Produce(ServiceStartBuildItem.class)\n    void detectUnsupportedSpringSecurityAnnotations(CombinedIndexBuildItem index) {\n        for (DotName unsupported : DotNames.UNSUPPORTED_SPRING_SECURITY_ANNOTATIONS) {\n            Collection<AnnotationInstance> instances = index.getIndex().getAnnotations(unsupported);\n            if (!instances.isEmpty()) {\n                AnnotationInstance first = instances.iterator().next();\n                AnnotationTarget target = first.target();\n                String location;\n                if (target.kind() == AnnotationTarget.Kind.METHOD) {\n                    MethodInfo method = target.asMethod();\n                    location = \"method '\" + method.name() + \"' of class '\" + method.declaringClass().name() + \"'\";\n                } else {\n                    location = \"class '\" + target.asClass().name() + \"'\";\n                }\n                throw new IllegalArgumentException(\n                        \"Quarkus does not support the @\" + unsupported.withoutPackagePrefix()\n                                + \" annotation, found on \" + location\n                                + \". Only @Secured and @PreAuthorize are supported.\"\n                                + \" See https://quarkus.io/guides/spring-security#supported-spring-security-annotations\");\n            }\n        }\n    }\n\n    @BuildStep\n    void registerSecurityInterceptors(BuildProducer<InterceptorBindingRegistrarBuildItem> registrars,\n            BuildProducer<AdditionalBeanBuildItem> beans) {\n        registrars.produce(new InterceptorBindingRegistrarBuildItem(new SpringSecurityAnnotationsRegistrar()));\n        beans.produce(new AdditionalBeanBuildItem(SpringSecuredInterceptor.class));\n        beans.produce(new AdditionalBeanBuildItem(SpringPreauthorizeInterceptor.class));\n    }\n\n    @Record(ExecutionTime.STATIC_INIT)\n    @BuildStep","sourceCodeStart":68,"sourceCodeEnd":104,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java#L68-L104","documentation":"The Quarkus Spring Security extension only supports @Secured and @PreAuthorize from Spring Security. During build, detectUnsupportedSpringSecurityAnnotations scans the application index for other Spring Security annotations (e.g. @PostAuthorize, @PostFilter, @PreFilter, @RolesAllowed from spring-security) and fails the build with this IllegalArgumentException naming the annotation and its location.","triggerScenarios":"Annotating a method or class with an unsupported Spring Security annotation such as @PostAuthorize, @PreFilter, @PostFilter, or @AuthenticationPrincipal while the quarkus-spring-security extension is present.","commonSituations":"Migrating an existing Spring Boot codebase whose controllers/services use @PostAuthorize or @PreFilter; IDE auto-imports adding Spring Security annotations; copying security code from Spring projects.","solutions":["Remove the unsupported annotation and replace its logic with @PreAuthorize or @Secured","If you need standard Jakarta annotations, use @RolesAllowed from Quarkus Security (quarkus-security) instead","For post-invocation checks, restructure code (e.g. perform the check inside the method) since post-authorization is not supported"],"exampleFix":"// before\n@PostAuthorize(\"returnObject.owner == authentication.name\")\npublic Account getAccount(Long id) { ... }\n\n// after\npublic Account getAccount(Long id) {\n    Account acc = ...;\n    if (!acc.getOwner().equals(identity.getPrincipal().getName())) {\n        throw new ForbiddenException();\n    }\n    return acc;\n}","handlingStrategy":"validation","validationCode":"// CI check: fail build if unsupported Spring Security annotations are present\nSet<String> unsupported = Set.of(\"PostAuthorize\", \"PreFilter\", \"PostFilter\", \"RunAs\");\nfor (String ann : unsupported) {\n    // search sources for org.springframework.security.access.annotation.<ann>\n    if (sourcesReference(\"org.springframework.security.access.annotation.\" + ann))\n        throw new IllegalStateException(\"Unsupported annotation: @\" + ann);\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Limit Spring Security imports to @Secured and @PreAuthorize","Use Quarkus @RolesAllowed/@Authenticated/@PermitAll for standard checks","Add an arch/import lint rule to reject other org.springframework.security annotations"],"tags":["spring-security","build-time","unsupported-annotation"],"backgroundTag":"unsupported-security-annotation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}