quarkusio/quarkus · error · IllegalStateException

Method %s of class %s is annotated with multiple security an

Error message

Method %s of class %s is annotated with multiple security annotations

What it means

A single method carries more than one security annotation (or is both annotated and registered as an additional secured method). Quarkus cannot merge arbitrary security checks for the same method, so application build fails.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java:1544

                    } else {
                        throw new IllegalStateException(
                                "Class " + target.asClass() + " is annotated with multiple security annotations "
                                        + instance.name()
                                        + " and " + existingClassInstance.name());
                    }
                }

            }
        }

        private void gatherMethodSecurityAnnotations() {
            // make sure we process annotations on methods first
            for (AnnotationInstance instance : annotationInstances) {
                AnnotationTarget target = instance.target();
                if (target.kind() == AnnotationTarget.Kind.METHOD) {
                    MethodInfo methodInfo = target.asMethod();
                    if (alreadyCheckedMethods.containsKey(methodInfo) || hasAdditionalSecurityAnnotation.test(methodInfo)) {
                        throw new IllegalStateException(
                                "Method " + methodInfo.name() + " of class " + methodInfo.declaringClass()
                                        + " is annotated with multiple security annotations");
                    }
                    alreadyCheckedMethods.put(methodInfo, instance);
                    putResult.accept(methodInfo, instance);
                }
            }
        }
    }

    private static final class AuthorizationTypeToSecurityAnnotationsBuildItem extends SimpleBuildItem {

        private final Map<AuthorizationType, Set<DotName>> result;

        private AuthorizationTypeToSecurityAnnotationsBuildItem(
                Map<AuthorizationType, Set<DotName>> authorizationTypeToSecurityAnnotations) {
            this.result = Collections.unmodifiableMap(authorizationTypeToSecurityAnnotations);
        }

View on GitHub (pinned to e1c734241f)

Solutions

Keep exactly one security annotation on the method; combine constraints in a single annotation (e.g. @PermissionsAllowed("admin", "read") or @RolesAllowed with multiple roles).
Remove the method from additional secured methods config if it is directly annotated.
If using custom stereotype/meta-annotations, ensure only one of them carries a Quarkus security annotation.

Example fix

// before
@RolesAllowed("admin")
@PermissionsAllowed("delete:user")
public void deleteUser() { ... }
// after
@PermissionsAllowed(value = "delete:user", rolesAllowed = "admin")
public void deleteUser() { ... }

Defensive patterns

Strategy: validation

Validate before calling

long n = Stream.of(RolesAllowed.class, PermissionsAllowed.class, Authenticated.class, DenyAll.class)
    .filter(a -> method.isAnnotationPresent(a)).count();
if (n > 1) throw new IllegalStateException("multiple security annotations on " + method);

Prevention

One security annotation per method
Do not list annotated methods in additional secured methods config
Audit stereotype annotations for nested security annotations

When it happens

Trigger: Method annotated with e.g. @RolesAllowed and @PermissionsAllowed simultaneously; or a method already annotated is also listed in additional secured methods config; or meta-annotations expand to two security annotations on one method.

Common situations: Migrating from @RolesAllowed to @PermissionsAllowed and leaving both; combining annotation-driven security with quarkus.security.additional-secured-methods for the same method; custom stereotype annotations that each carry a security annotation.

Related errors

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/4e458ecd389d54ad. Report an issue: GitHub.