quarkusio/quarkus · error · RuntimeException

Only one of the '<annotations>' annotations can be applied o

Error message

Only one of the '<annotations>' annotations can be applied on the '<method>' method

What it means

A single endpoint method may only carry one of the mutually exclusive auth mechanism annotations (like @Basic, @Form), unless the specific interceptor binding explicitly allows repetition (e.g. @Tenant). Duplicates or conflicting mechanisms on one method cause a build failure naming the method.

Source

Thrown at extensions/vertx-http/deployment/src/main/java/io/quarkus/vertx/http/deployment/HttpSecurityProcessor.java:903

                                }
                            }
                        }
                    } else {
                        MethodInfo mi = annotation.target().asMethod();

                        if (hasClassLevelSecurity.test(mi.declaringClass())) {
                            throw new RuntimeException(
                                    ("Security annotations '%s' cannot be applied on the '%s' method, "
                                            + "please move the annotations to the class-level instead").formatted(
                                                    Arrays.toString(Arrays.stream(interceptorBinding.getAnnotationBindings())
                                                            .toArray()),
                                                    toTargetName(mi)));
                        } else {
                            // only allow to combine interceptor bindings on endpoints if we explicitly support it
                            var appliedBindings = cache.computeIfAbsent(mi, a -> new ArrayList<>());
                            if (appliedBindings.contains(interceptorBinding)) {
                                if (!interceptorBinding.allowToRepeatThisInterceptorBinding()) {
                                    throw new RuntimeException(
                                            "Only one of the '%s' annotations can be applied on the '%s' method".formatted(
                                                    Arrays.toString(interceptorBinding.getAnnotationBindings()),
                                                    toTargetName(mi)));
                                }
                            } else {
                                appliedBindings.add(interceptorBinding);
                            }
                        }

                        addInterceptedEndpoint(mi, annotation, annotationBinding, bindingValueToInterceptedMethods,
                                interceptorBinding);
                    }
                }
                if (!bindingValueToInterceptedMethods.isEmpty()) {
                    result.compute(annotationBinding, (key, existingMap) -> {
                        if (existingMap == null) {
                            return bindingValueToInterceptedMethods;
                        } else {

View on GitHub (pinned to e1c734241f)

Solutions

1. Keep only one auth mechanism annotation on the method and remove the other
2. If repetition is legitimately required, use an annotation that allows it (e.g. @Tenant)
3. Use quarkus.http.auth.permission config for compound rules instead

Example fix

// before
@GET
@Basic
@Form
public String get() { ... }
// after
@GET
@Basic
public String get() { ... }

long count = Arrays.stream(method.getAnnotations())
    .map(Annotation::annotationType)
    .filter(t -> Set.of(Basic.class, Form.class, BearerAuth.class).contains(t))
    .count();
if (count > 1) throw new IllegalStateException("Only one auth mechanism annotation allowed on method");

When it happens

Trigger: Annotating the same endpoint method with two auth mechanism annotations that don't allow repetition.

Common situations: Copy-pasting annotations onto a method that already had one; combining @Basic with @Form on one endpoint expecting fallback behavior; IDE auto-import adding an unintended annotation.

Related errors

• @PermissionChecker annotation placed on the '%s' attribute '
• The @AuthorizationPolicy annotation placed on '<target>' mus
• Only one of the '<annotations>' annotations can be applied o
• Security annotations '<annotations>' cannot be applied on th
• The configuration ${clazz} is missing the @ConfigRoot annota

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/1eb95e980ef771ef. Report an issue: GitHub.