{"record":{"id":"ec811f4d206e3e41","repo":"quarkusio/quarkus","slug":"authorization-has-already-been-set","errorCode":null,"errorMessage":"Authorization has already been set","messagePattern":"Authorization has already been set","errorType":"exception","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java","lineNumber":404,"sourceCode":"\n        private void requireAuthenticationByDefault() {\n            // if someone selects authentication mechanism and doesn't configure\n            // authorization policy, it is reasonable to expect they require authentication\n            // similarly to what we do with @BasicAuthentication etc.\n            if (authorizationPolicy == null) {\n                authenticated();\n            }\n        }\n\n        private void validateAuthenticationNotSetYet() {\n            if (authMechanism != null) {\n                throw new IllegalArgumentException(\"Authentication has already been set\");\n            }\n        }\n\n        private void validateAuthorizationNotSetYet() {\n            if (authMechanism == null && authorizationPolicy != null) {\n                throw new IllegalArgumentException(\"Authorization has already been set\");\n            }\n        }\n\n        @Override\n        public HttpPermission basic() {\n            return authenticatedWith(BasicAuthentication.AUTH_MECHANISM_SCHEME);\n        }\n\n        @Override\n        public HttpPermission form() {\n            return authenticatedWith(FormAuthentication.AUTH_MECHANISM_SCHEME);\n        }\n\n        @Override\n        public HttpPermission mTLS() {\n            boolean mTlsDisabled = ClientAuth.NONE.equals(clientAuth);\n            if (mTlsDisabled) {\n                throw new IllegalStateException(","sourceCodeStart":386,"sourceCodeEnd":422,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/vertx-http/runtime/src/main/java/io/quarkus/vertx/http/runtime/security/HttpSecurityImpl.java#L386-L422","documentation":"Thrown by validateAuthorizationNotSetYet when authorization() is called on a HttpPermission whose authorizationPolicy is already set while no authentication mechanism (authMechanism) has been configured. The authorization() method pairs a custom policy with an implicit authentication requirement, so a pre-existing policy makes the call invalid.","triggerScenarios":"Calling .roles(...) or .permissions(...) (which set authorizationPolicy) followed by .authorization(policy) on the same HttpPermission, without an intermediate authenticated()/authenticatedWith(...) call.","commonSituations":"Migrating from roles()/permissions() style config to a custom HttpSecurityPolicy with authorization() on the same builder; helper methods that each set an authorization policy on a shared permission.","solutions":["Call authorization(...) only once per HttpPermission, before any roles()/permissions() call.","Remove the earlier roles()/permissions() call if the custom policy in authorization() should govern.","Use a fresh permission from paths() for the custom authorization policy."],"exampleFix":"// before\nvar perm = httpSecurity.paths(\"/api/*\").roles(\"admin\");\nperm.authorization(myPolicy); // throws\n// after\nhttpSecurity.paths(\"/api/*\").authorization(myPolicy);","handlingStrategy":"validation","validationCode":"if (permUsesRolesOrPermissions) { /* do not call authorization(...) on the same permission */ }","typeGuard":null,"tryCatchPattern":"try { perm.authorization(policy); } catch (IllegalArgumentException e) { if (!e.getMessage().contains(\"Authorization has already been set\")) throw e; }","preventionTips":["Choose either the roles()/permissions() style or authorization(customPolicy) per permission, not both.","Call authorization() first in the chain, before any path/method modifiers that might set policy.","Isolate custom-policy rules in their own paths(...) chains."],"tags":["quarkus","http-security","authorization","fluent-builder"],"backgroundTag":"builder-state-already-set","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}