quarkusio/quarkus · error · IllegalArgumentException

An invalid security annotation combination was detected: Fou

Error message

An invalid security annotation combination was detected: Found <instance> and <securityAnnotation> on method <method>

What it means

Same annotation-conflict rule as the class-level check, but applied to methods: a method cannot be annotated with both a Spring Security annotation and a standard Quarkus security annotation. checksStandardSecurity throws this IllegalArgumentException at build time, listing both annotation names and the method.

Source

Thrown at extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java:196

                        .withoutPackagePrefix();
                throw new IllegalArgumentException("An invalid security annotation combination was detected: Found @"
                        + instance.name().withoutPackagePrefix() + " and @" + securityAnnotationName + " on class "
                        + classInfo.simpleName());
            }
        }
    }

    //Validates that there is no @Secured with the standard security annotations at method level
    private void checksStandardSecurity(AnnotationInstance instance, MethodInfo methodInfo,
            SecurityTransformer securityTransformer) {
        if (securityTransformer.hasSecurityAnnotation(methodInfo)) {
            Optional<AnnotationInstance> firstStandardSecurityAnnotation = securityTransformer
                    .findFirstSecurityAnnotation(methodInfo);
            if (firstStandardSecurityAnnotation.isPresent()) {
                String securityAnnotationName = securityTransformer.findFirstSecurityAnnotation(methodInfo).get()
                        .name()
                        .withoutPackagePrefix();
                throw new IllegalArgumentException("An invalid security annotation combination was detected: Found "
                        + instance.name().withoutPackagePrefix() + " and " + securityAnnotationName + " on method "
                        + methodInfo.name());
            }
        }
    }

    private boolean isPublicNonStaticNonConstructor(MethodInfo methodInfo) {
        return Modifier.isPublic(methodInfo.flags()) && !Modifier.isStatic(methodInfo.flags())
                && !"<init>".equals(methodInfo.name());
    }

    @BuildStep
    void locatePreAuthorizedInstances(
            CombinedIndexBuildItem index,
            BuildProducer<SpringPreAuthorizeAnnotatedMethodBuildItem> springPreAuthorizeAnnotatedMethods,
            BuildProducer<AnnotationsTransformerBuildItem> annotationsTransformer,
            Optional<SecurityTransformerBuildItem> securityTransformerBuildItem) {
        SecurityTransformer securityTransformer = SecurityTransformerBuildItem.createSecurityTransformer(index.getIndex(),

View on GitHub (pinned to e1c734241f)

Solutions

1. Delete one of the two annotations on the method
2. Keep the Spring Security annotation and remove @RolesAllowed (or the reverse) on that method
3. Unify the project on one security annotation style to avoid recurrence

Example fix

// before
@PreAuthorize("hasRole('ROLE_ADMIN')")
@RolesAllowed("admin")
public void delete(String id) { }

// after
@PreAuthorize("hasRole('ROLE_ADMIN')")
public void delete(String id) { }

Method m = AdminResource.class.getMethod("delete", String.class);
boolean spring = m.isAnnotationPresent(PreAuthorize.class) || m.isAnnotationPresent(Secured.class);
boolean standard = m.isAnnotationPresent(RolesAllowed.class) || m.isAnnotationPresent(PermitAll.class);
if (spring && standard) throw new IllegalStateException("Mixed security annotations on method");

When it happens

Trigger: A method is annotated with, for example, both @PreAuthorize("hasRole('admin')") and @RolesAllowed("admin"), detected while locating @PreAuthorize/@Secured instances on methods.

Common situations: Adding a Spring Security expression to an endpoint that already had @RolesAllowed; a refactoring that merged two secured handlers; copy-paste of annotations from different codebases.

Related errors

• An invalid security annotation combination was detected: Fou
• Parameter with index <i> of method '<beanMethod>' found in e
• Parameter with index <i> of method '<beanMethod>' found in e
• Could not match a unique method name '<methodName>' for bean
• Could not find a public, boolean returning method named '<me

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/b81e71d9f966d6a2. Report an issue: GitHub.