{"record":{"id":"17aa412716f94cfb","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-be-empty","errorCode":null,"errorMessage":"SPIFFE ID must not be empty","messagePattern":"SPIFFE ID must not be empty","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":68,"sourceCode":"        if (keyUsage == null || keyUsage.length <= 5 || !keyUsage[5]) {\n            throw new SpiffeConnectionException(\n                    \"Signing certificate must have 'keyCertSign' as key usage: \" + cert.getSubjectX500Principal());\n        }\n        // X.509-SVID 3.2 MUST: if signing cert has a SPIFFE ID, it must not have a path component\n        String uriSan = extractOptionalUriSan(cert);\n        if (uriSan != null && uriSan.startsWith(SPIFFE_URI_PREFIX)) {\n            URI uri = URI.create(uriSan);\n            String path = uri.getPath();\n            if (path != null && !path.isEmpty() && !\"/\".equals(path)) {\n                throw new SpiffeConnectionException(\n                        \"Signing certificate SPIFFE ID must not have a path component: \" + uriSan);\n            }\n        }\n    }\n\n    static void validateSpiffeId(String spiffeId) throws SpiffeConnectionException {\n        if (spiffeId == null || spiffeId.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not be empty\");\n        }\n        if (spiffeId.length() > MAX_SPIFFE_ID_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID exceeds maximum length of \" + MAX_SPIFFE_ID_LENGTH\n                    + \" bytes: \" + spiffeId.length());\n        }\n\n        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);","sourceCodeStart":50,"sourceCodeEnd":86,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L50-L86","documentation":"SpiffeValidator.validateSpiffeId requires a non-null, non-empty SPIFFE ID string; an empty (or null) ID is not a valid SPIFFE URI and is rejected with SpiffeConnectionException before any other checks.","triggerScenarios":"Passing null or \"\" to SPIFFE ID validation — typically an unset workload identity configuration property, an empty env var, or a workload API response missing the ID field.","commonSituations":"quarkus.spiffe.* config key left empty in application.properties; SPIFFE_WORKLOAD_API socket configured but agent returned an empty identity; startup code reading an env variable that is not set.","solutions":["Set the SPIFFE ID / workload identity in your configuration (e.g. quarkus.spiffe.<...>.spiffe-id) to a full spiffe://trust-domain/path value.","Ensure the SPIFFE workload agent is running and returns a valid SVID for the workload.","Add a startup check that fails fast with a clear message when the ID is missing."],"exampleFix":"// before\n# application.properties\nquarkus.spiffe.cert-source.spiffe-id=\n// after\nquarkus.spiffe.cert-source.spiffe-id=spiffe://example.org/ns/default/sa/my-service","handlingStrategy":"validation","validationCode":"if (spiffeId == null || spiffeId.isEmpty()) {\n    throw new IllegalStateException(\"SPIFFE ID must be configured (spiffe://trust-domain/path)\");\n}","typeGuard":null,"tryCatchPattern":"try {\n    connection.establish();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"must not be empty\")) {\n        log.error(\"No SPIFFE ID configured; check quarkus.spiffe.* properties and workload agent\", e);\n    }\n    throw e;\n}","preventionTips":["Set the spiffe-id config property explicitly and keep it in source control","Fail fast at startup if the identity env/config is absent","Confirm the SPIRE agent returns a valid SVID for the workload"],"tags":["spiffe","validation","configuration"],"backgroundTag":"spiffe-id-validation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}