{"record":{"id":"1278664997e13c29","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-contain-userinfo-spiffeid","errorCode":null,"errorMessage":"SPIFFE ID must not contain userinfo: ${spiffeId}","messagePattern":"SPIFFE ID must not contain userinfo: (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":90,"sourceCode":"                    + \" bytes: \" + spiffeId.length());\n        }\n\n        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);","sourceCodeStart":72,"sourceCodeEnd":108,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L72-L108","documentation":"Per the SPIFFE standard, IDs must not contain a userinfo component (user@host syntax). SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when URI.getUserInfo() returns non-null, since spiffe://user@example.org is not a valid SPIFFE ID.","triggerScenarios":"An ID like spiffe://admin@example.org/ns/default/sa/app — e.g. credentials accidentally prepended to the trust domain, or a URI assembled from a URL that includes user info.","commonSituations":"Copying a connection string (with username@host) into a SPIFFE ID field; templating that mixes authentication config with identity config; automated code that reuses a full URL as the ID.","solutions":["Remove the userinfo portion so the ID starts directly with the trust domain (spiffe://example.org/...).","Store credentials and SPIFFE IDs in separate configuration properties.","Strip/validate user info where the ID string is assembled."],"exampleFix":"// before\nString id = \"spiffe://\" + user + \"@\" + trustDomain + \"/ns/default/sa/app\";\n// after\nString id = \"spiffe://\" + trustDomain + \"/ns/default/sa/app\";","handlingStrategy":"validation","validationCode":"if (URI.create(spiffeId).getUserInfo() != null) {\n    throw new IllegalStateException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n}","typeGuard":null,"tryCatchPattern":"try {\n    connection.establish();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"userinfo\")) {\n        log.error(\"SPIFFE ID contains user@host; separate credentials from identity config\", e);\n    }\n    throw e;\n}","preventionTips":["Never concatenate credentials or connection strings into SPIFFE IDs","Keep auth config and identity config in distinct properties","Validate the parsed URI parts before storing the ID"],"tags":["spiffe","validation","uri"],"backgroundTag":"spiffe-id-validation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}