quarkusio/quarkus · error · IllegalArgumentException

An invalid security annotation combination was detected: Fou

Error message

An invalid security annotation combination was detected: Found @<instance> and @<securityAnnotation> on class <class>

What it means

Quarkus forbids mixing a Spring Security annotation (@Secured or @PreAuthorize) with one of Quarkus's own standard security annotations (@RolesAllowed, @Authenticated, @PermitAll, @DenyAll) on the same class. checksStandardSecurity detects the combination and throws this IllegalArgumentException at build time because the two security models cannot be reconciled.

Source

Thrown at extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java:179

        List<AnnotationInstance> annotations = methodInfo.annotations();
        for (AnnotationInstance instance : annotations) {
            if (toCheck.contains(instance.name())) {
                return true;
            }
        }
        return false;
    }

    //Validates that there is no @Secured with the standard security annotations at class level
    private void checksStandardSecurity(AnnotationInstance instance, ClassInfo classInfo,
            SecurityTransformer securityTransformer) {
        if (securityTransformer.hasSecurityAnnotation(classInfo)) {
            Optional<AnnotationInstance> firstStandardSecurityAnnotation = securityTransformer
                    .findFirstSecurityAnnotation(classInfo);
            if (firstStandardSecurityAnnotation.isPresent()) {
                String securityAnnotationName = securityTransformer.findFirstSecurityAnnotation(classInfo).get().name()
                        .withoutPackagePrefix();
                throw new IllegalArgumentException("An invalid security annotation combination was detected: Found @"
                        + instance.name().withoutPackagePrefix() + " and @" + securityAnnotationName + " on class "
                        + classInfo.simpleName());
            }
        }
    }

    //Validates that there is no @Secured with the standard security annotations at method level
    private void checksStandardSecurity(AnnotationInstance instance, MethodInfo methodInfo,
            SecurityTransformer securityTransformer) {
        if (securityTransformer.hasSecurityAnnotation(methodInfo)) {
            Optional<AnnotationInstance> firstStandardSecurityAnnotation = securityTransformer
                    .findFirstSecurityAnnotation(methodInfo);
            if (firstStandardSecurityAnnotation.isPresent()) {
                String securityAnnotationName = securityTransformer.findFirstSecurityAnnotation(methodInfo).get()
                        .name()
                        .withoutPackagePrefix();
                throw new IllegalArgumentException("An invalid security annotation combination was detected: Found "
                        + instance.name().withoutPackagePrefix() + " and " + securityAnnotationName + " on method "

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove one of the annotations — keep either the Spring Security annotation or the standard one on the class
2. If class-level @RolesAllowed is desired, drop @Secured/@PreAuthorize from the class and use it consistently project-wide
3. Move the Spring Security expression to the method level and keep the standard annotation only where appropriate, but never both on the same target

Example fix

// before
@Secured("ROLE_ADMIN")
@RolesAllowed("admin")
public class AdminResource { }

// after
@RolesAllowed("admin")
public class AdminResource { }

// project convention check: a class must not mix annotation families
boolean hasSpring = AdminResource.class.isAnnotationPresent(Secured.class);
boolean hasStandard = AdminResource.class.isAnnotationPresent(RolesAllowed.class);
if (hasSpring && hasStandard) throw new IllegalStateException("Mixed security annotations on class");

When it happens

Trigger: A class carries both a Spring Security annotation (e.g. @Secured("ROLE_ADMIN")) and a standard annotation (e.g. @RolesAllowed("admin")); detected while processing the class-level annotation.

Common situations: Incremental migration from @RolesAllowed to Spring Security annotations (or vice versa) leaving both on a class; a base class or imported controller that already has the other annotation.

Related errors

• An invalid security annotation combination was detected: Fou
• Parameter with index <i> of method '<beanMethod>' found in e
• Parameter with index <i> of method '<beanMethod>' found in e
• Could not match a unique method name '<methodName>' for bean
• Could not find a public, boolean returning method named '<me

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/21d8353366b8d985. Report an issue: GitHub.