Multiple @Security tags?

[Michael Short]

Using multiple security tags does not seem to work on a specific route or controller. It only uses the first one.

Is this supported?

[Michael Short]

The answer is no, it is not supported. It looks like roles and authenticator are hard-coded properties on the decorated object, so additional @Security tags just overwrite it.

return new ServiceDecorator('Security')
    .withProperty('roles', roles)
    .withProperty('authenticator', name || 'default')

buildSecurityMiddlewares(serviceClass, serviceMethod) {
    let roles = _.compact(_.union(serviceMethod.roles, serviceClass.roles));
    const authenticatorName = serviceMethod.authenticator || serviceClass.authenticator;