diff --git a/web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java b/web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java
index dbe3b5c004..9d82990e80 100644
--- a/web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java
+++ b/web/src/main/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapper.java
@@ -150,7 +150,7 @@ public class SecurityContextHolderAwareRequestWrapper extends HttpServletRequest
 	private boolean isGranted(String role) {
 		Authentication auth = getAuthentication();
 
-		if (rolePrefix != null) {
+		if (rolePrefix != null && role != null && !role.startsWith(rolePrefix)) {
 			role = rolePrefix + role;
 		}
 
diff --git a/web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java b/web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java
index 91f11a3629..def19cb28f 100644
--- a/web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java
+++ b/web/src/test/java/org/springframework/security/web/servletapi/SecurityContextHolderAwareRequestWrapperTests.java
@@ -114,4 +114,33 @@ public class SecurityContextHolderAwareRequestWrapperTests extends TestCase {
 		assertFalse(wrapper.isUserInRole("ROLE_FOOBAR")); // principal is null, so reject
 		assertNull(wrapper.getUserPrincipal());
 	}
+
+	public void testRolePrefix() {
+		Authentication auth = new TestingAuthenticationToken("user", "koala", "ROLE_HELLO",
+				"ROLE_FOOBAR");
+		SecurityContextHolder.getContext().setAuthentication(auth);
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+
+		SecurityContextHolderAwareRequestWrapper wrapper = new SecurityContextHolderAwareRequestWrapper(
+				request, "ROLE_");
+
+		assertTrue(wrapper.isUserInRole("HELLO"));
+		assertTrue(wrapper.isUserInRole("FOOBAR"));
+	}
+
+	// SEC-3020
+	public void testRolePrefixNotAppliedIfRoleStartsWith() {
+		Authentication auth = new TestingAuthenticationToken("user", "koala", "ROLE_HELLO",
+				"ROLE_FOOBAR");
+		SecurityContextHolder.getContext().setAuthentication(auth);
+
+		MockHttpServletRequest request = new MockHttpServletRequest();
+
+		SecurityContextHolderAwareRequestWrapper wrapper = new SecurityContextHolderAwareRequestWrapper(
+				request, "ROLE_");
+
+		assertTrue(wrapper.isUserInRole("ROLE_HELLO"));
+		assertTrue(wrapper.isUserInRole("ROLE_FOOBAR"));
+	}
 }