{"record":{"id":"f11ead9bc7bae02f","repo":"quarkusio/quarkus","slug":"method-s-s-should-not-have-been-added-as-an-addi-f11ead","errorCode":null,"errorMessage":"Method %s#%s should not have been added as an additional secured method as it's already annotated with @DenyAll.","messagePattern":"Method (.+?)#(.+?) should not have been added as an additional secured method as it's already annotated with @DenyAll\\.","errorType":"exception","errorClass":"IllegalStateException","httpStatus":null,"severity":"error","filePath":"extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java","lineNumber":1144,"sourceCode":"                continue;\n            }\n            AnnotationInstance alreadyExistingInstance = methodToInstanceCollector.get(additionalSecuredMethod.methodInfo);\n            if (additionalSecuredMethod.rolesAllowed.isPresent()) {\n                if (alreadyExistingInstance == null) {\n                    methodToRoles.put(additionalSecuredMethod.methodInfo,\n                            additionalSecuredMethod.rolesAllowed.get().toArray(String[]::new));\n                } else if (alreadyHasAnnotation(alreadyExistingInstance, ROLES_ALLOWED)) {\n                    // we should not try to add second @RolesAllowed\n                    throw new IllegalStateException(\"Method \" + additionalSecuredMethod.methodInfo.declaringClass() + \"#\"\n                            + additionalSecuredMethod.methodInfo.name() + \" should not have been added as an additional \"\n                            + \"secured method as it's already annotated with @RolesAllowed.\");\n                }\n            } else {\n                if (alreadyExistingInstance == null) {\n                    result.put(additionalSecuredMethod.methodInfo, recorder.denyAll());\n                } else if (alreadyHasAnnotation(alreadyExistingInstance, DENY_ALL)) {\n                    // we should not try to add second @DenyAll\n                    throw new IllegalStateException(\"Method \" + additionalSecuredMethod.methodInfo.declaringClass() + \"#\"\n                            + additionalSecuredMethod.methodInfo.name() + \" should not have been added as an additional \"\n                            + \"secured method as it's already annotated with @DenyAll.\");\n                }\n            }\n        }\n\n        // create roles allowed security checks\n        // we create only one security check for each role set\n        Map<Set<String>, SecurityCheck> cache = new HashMap<>();\n        final AtomicInteger keyIndex = new AtomicInteger(0);\n        final AtomicBoolean hasRolesAllowedCheckWithConfigExp = new AtomicBoolean(false);\n        for (Map.Entry<MethodInfo, String[]> entry : methodToRoles.entrySet().stream()\n                .sorted(Map.Entry.comparingByKey(Comparator.comparing(MethodInfo::toString))).toList()) {\n            final MethodInfo methodInfo = entry.getKey();\n            result.put(methodInfo,\n                    computeRolesAllowedCheck(cache, hasRolesAllowedCheckWithConfigExp, keyIndex, recorder, entry.getValue()));\n        }\n","sourceCodeStart":1126,"sourceCodeEnd":1162,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java#L1126-L1162","documentation":"During Quarkus build, additional secured methods are collected and @DenyAll is applied to them. If a method was already annotated with @DenyAll on the class, adding it again as an 'additional secured method' is contradictory, so the build fails with IllegalStateException. This catches configuration bugs where the same method is secured twice via different mechanisms.","triggerScenarios":"A method already annotated @DenyAll is additionally registered through quarkus.security.'additional-secured-methods' config, an additional-secured build item, or an extension recorder that adds it as an additional secured method.","commonSituations":"Combining @DenyAll on a JAX-RS/CDI method with quarkus.http.auth.permission or application.properties additional secured method entries targeting the same method; migrating config where a legacy security rule duplicates an explicit annotation.","solutions":["Remove the explicit @DenyAll annotation from the method and let the additional secured method config secure it, or remove the additional secured method registration that targets the method.","Search your configuration (quarkus.security.additional-secured-methods or equivalent build items) for the fully qualified method name and delete the duplicate entry.","If an extension registers the method, restrict its predicate to methods that are not already @DenyAll."],"exampleFix":"// before\n@DenyAll\npublic String secret() { ... }\n// plus quarkus.security.additional-secured-methods=com.acme.SecretResource#secret\n// after (choose one mechanism)\n@DenyAll\npublic String secret() { ... }\n// additional-secured-methods entry removed","handlingStrategy":"validation","validationCode":"// before build, check duplicates\nvar annotated = Set.of(\"com.acme.SecretResource#secret\");\nvar configured = config.getOptionalValue(\"quarkus.security.additional-secured-methods\", String.class)\n    .stream().flatMap(s -> Arrays.stream(s.split(\",\"))).collect(Collectors.toSet());\nif (annotated.stream().anyMatch(configured::contains)) throw new IllegalStateException(\"duplicate secured method\");","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Secure each method through exactly one mechanism (annotation or config)","Grep config for additional-secured-methods entries when adding @DenyAll","Keep security rules centralized to spot duplicates"],"tags":["quarkus","security","build-time","duplicate-annotation"],"backgroundTag":"duplicate-security-annotation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}