quarkusio/quarkus · error · IllegalArgumentException

Quarkus does not support the @<annotation> annotation, found

Error message

Quarkus does not support the @<annotation> annotation, found on <location>. Only @Secured and @PreAuthorize are supported. See https://quarkus.io/guides/spring-security#supported-spring-security-annotations

What it means

The Quarkus Spring Security extension only supports @Secured and @PreAuthorize from Spring Security. During build, detectUnsupportedSpringSecurityAnnotations scans the application index for other Spring Security annotations (e.g. @PostAuthorize, @PostFilter, @PreFilter, @RolesAllowed from spring-security) and fails the build with this IllegalArgumentException naming the annotation and its location.

Source

Thrown at extensions/spring-security/deployment/src/main/java/io/quarkus/spring/security/deployment/SpringSecurityProcessor.java:86

        return new FeatureBuildItem(Feature.SPRING_SECURITY);
    }

    @BuildStep
    @Produce(ServiceStartBuildItem.class)
    void detectUnsupportedSpringSecurityAnnotations(CombinedIndexBuildItem index) {
        for (DotName unsupported : DotNames.UNSUPPORTED_SPRING_SECURITY_ANNOTATIONS) {
            Collection<AnnotationInstance> instances = index.getIndex().getAnnotations(unsupported);
            if (!instances.isEmpty()) {
                AnnotationInstance first = instances.iterator().next();
                AnnotationTarget target = first.target();
                String location;
                if (target.kind() == AnnotationTarget.Kind.METHOD) {
                    MethodInfo method = target.asMethod();
                    location = "method '" + method.name() + "' of class '" + method.declaringClass().name() + "'";
                } else {
                    location = "class '" + target.asClass().name() + "'";
                }
                throw new IllegalArgumentException(
                        "Quarkus does not support the @" + unsupported.withoutPackagePrefix()
                                + " annotation, found on " + location
                                + ". Only @Secured and @PreAuthorize are supported."
                                + " See https://quarkus.io/guides/spring-security#supported-spring-security-annotations");
            }
        }
    }

    @BuildStep
    void registerSecurityInterceptors(BuildProducer<InterceptorBindingRegistrarBuildItem> registrars,
            BuildProducer<AdditionalBeanBuildItem> beans) {
        registrars.produce(new InterceptorBindingRegistrarBuildItem(new SpringSecurityAnnotationsRegistrar()));
        beans.produce(new AdditionalBeanBuildItem(SpringSecuredInterceptor.class));
        beans.produce(new AdditionalBeanBuildItem(SpringPreauthorizeInterceptor.class));
    }

    @Record(ExecutionTime.STATIC_INIT)
    @BuildStep

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove the unsupported annotation and replace its logic with @PreAuthorize or @Secured
2. If you need standard Jakarta annotations, use @RolesAllowed from Quarkus Security (quarkus-security) instead
3. For post-invocation checks, restructure code (e.g. perform the check inside the method) since post-authorization is not supported

Example fix

// before
@PostAuthorize("returnObject.owner == authentication.name")
public Account getAccount(Long id) { ... }

// after
public Account getAccount(Long id) {
    Account acc = ...;
    if (!acc.getOwner().equals(identity.getPrincipal().getName())) {
        throw new ForbiddenException();
    }
    return acc;
}

// CI check: fail build if unsupported Spring Security annotations are present
Set<String> unsupported = Set.of("PostAuthorize", "PreFilter", "PostFilter", "RunAs");
for (String ann : unsupported) {
    // search sources for org.springframework.security.access.annotation.<ann>
    if (sourcesReference("org.springframework.security.access.annotation." + ann))
        throw new IllegalStateException("Unsupported annotation: @" + ann);
}

When it happens

Trigger: Annotating a method or class with an unsupported Spring Security annotation such as @PostAuthorize, @PreFilter, @PostFilter, or @AuthenticationPrincipal while the quarkus-spring-security extension is present.

Common situations: Migrating an existing Spring Boot codebase whose controllers/services use @PostAuthorize or @PreFilter; IDE auto-imports adding Spring Security annotations; copying security code from Spring projects.

Related errors

• Parameter with index <i> of method '<beanMethod>' found in e
• Parameter with index <i> of method '<beanMethod>' found in e
• Could not match a unique method name '<methodName>' for bean
• Could not find a public, boolean returning method named '<me
• Expression: '<expression>' in the @PreAuthorize annotation o

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/e8fddfea76e914a5. Report an issue: GitHub.