quarkusio/quarkus · error · IllegalStateException

Method %s#%s should not have been added as an additional sec

Error message

Method %s#%s should not have been added as an additional secured method as it's already annotated with @DenyAll.

What it means

During Quarkus build, additional secured methods are collected and @DenyAll is applied to them. If a method was already annotated with @DenyAll on the class, adding it again as an 'additional secured method' is contradictory, so the build fails with IllegalStateException. This catches configuration bugs where the same method is secured twice via different mechanisms.

Source

Thrown at extensions/security/deployment/src/main/java/io/quarkus/security/deployment/SecurityProcessor.java:1144

                continue;
            }
            AnnotationInstance alreadyExistingInstance = methodToInstanceCollector.get(additionalSecuredMethod.methodInfo);
            if (additionalSecuredMethod.rolesAllowed.isPresent()) {
                if (alreadyExistingInstance == null) {
                    methodToRoles.put(additionalSecuredMethod.methodInfo,
                            additionalSecuredMethod.rolesAllowed.get().toArray(String[]::new));
                } else if (alreadyHasAnnotation(alreadyExistingInstance, ROLES_ALLOWED)) {
                    // we should not try to add second @RolesAllowed
                    throw new IllegalStateException("Method " + additionalSecuredMethod.methodInfo.declaringClass() + "#"
                            + additionalSecuredMethod.methodInfo.name() + " should not have been added as an additional "
                            + "secured method as it's already annotated with @RolesAllowed.");
                }
            } else {
                if (alreadyExistingInstance == null) {
                    result.put(additionalSecuredMethod.methodInfo, recorder.denyAll());
                } else if (alreadyHasAnnotation(alreadyExistingInstance, DENY_ALL)) {
                    // we should not try to add second @DenyAll
                    throw new IllegalStateException("Method " + additionalSecuredMethod.methodInfo.declaringClass() + "#"
                            + additionalSecuredMethod.methodInfo.name() + " should not have been added as an additional "
                            + "secured method as it's already annotated with @DenyAll.");
                }
            }
        }

        // create roles allowed security checks
        // we create only one security check for each role set
        Map<Set<String>, SecurityCheck> cache = new HashMap<>();
        final AtomicInteger keyIndex = new AtomicInteger(0);
        final AtomicBoolean hasRolesAllowedCheckWithConfigExp = new AtomicBoolean(false);
        for (Map.Entry<MethodInfo, String[]> entry : methodToRoles.entrySet().stream()
                .sorted(Map.Entry.comparingByKey(Comparator.comparing(MethodInfo::toString))).toList()) {
            final MethodInfo methodInfo = entry.getKey();
            result.put(methodInfo,
                    computeRolesAllowedCheck(cache, hasRolesAllowedCheckWithConfigExp, keyIndex, recorder, entry.getValue()));
        }

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the explicit @DenyAll annotation from the method and let the additional secured method config secure it, or remove the additional secured method registration that targets the method.
2. Search your configuration (quarkus.security.additional-secured-methods or equivalent build items) for the fully qualified method name and delete the duplicate entry.
3. If an extension registers the method, restrict its predicate to methods that are not already @DenyAll.

Example fix

// before
@DenyAll
public String secret() { ... }
// plus quarkus.security.additional-secured-methods=com.acme.SecretResource#secret
// after (choose one mechanism)
@DenyAll
public String secret() { ... }
// additional-secured-methods entry removed

// before build, check duplicates
var annotated = Set.of("com.acme.SecretResource#secret");
var configured = config.getOptionalValue("quarkus.security.additional-secured-methods", String.class)
    .stream().flatMap(s -> Arrays.stream(s.split(","))).collect(Collectors.toSet());
if (annotated.stream().anyMatch(configured::contains)) throw new IllegalStateException("duplicate secured method");

When it happens

Trigger: A method already annotated @DenyAll is additionally registered through quarkus.security.'additional-secured-methods' config, an additional-secured build item, or an extension recorder that adds it as an additional secured method.

Common situations: Combining @DenyAll on a JAX-RS/CDI method with quarkus.http.auth.permission or application.properties additional secured method entries targeting the same method; migrating config where a legacy security rule duplicates an explicit annotation.

Related errors

• Class %s is annotated with multiple security annotations %s
• Method %s of class %s is annotated with multiple security an
• @PermissionChecker annotation placed on the '%s' attribute '
• @PermissionChecker annotation instance placed on the '%s' re
• Detected two @PermissionChecker annotations with same value

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/f11ead9bc7bae02f. Report an issue: GitHub.