{"record":{"id":"1fc2baf10d1d54b5","repo":"quarkusio/quarkus","slug":"audiences-must-not-be-empty","errorCode":null,"errorMessage":"Audiences must not be empty","messagePattern":"Audiences must not be empty","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":156,"sourceCode":"                    \"No default audiences configured via 'quarkus.spiffe-client.audiences'; \"\n                            + \"either configure default audiences or use getWorkloadJsonWebToken(String) with an explicit audience\");\n        }\n        return fetchWorkloadJsonWebTokens(defaultAudiences).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(String audience) {\n        validateAudience(audience);\n        return fetchWorkloadJsonWebTokens(Set.of(audience)).toUni();\n    }\n\n    @Override\n    public Uni<WorkloadJsonWebToken> getWorkloadJsonWebToken(Set<String> audiences) {\n        if (audiences == null) {\n            throw new IllegalArgumentException(\"Audiences must not be null\");\n        }\n        if (audiences.isEmpty()) {\n            throw new IllegalArgumentException(\"Audiences must not be empty\");\n        }\n        for (String audience : audiences) {\n            validateAudience(audience);\n        }\n        return fetchWorkloadJsonWebTokens(audiences).toUni();\n    }\n\n    @PreDestroy\n    void close() {\n        client.close();\n    }\n\n    private Multi<WorkloadJsonWebToken> fetchWorkloadJsonWebTokens(Set<String> audiences) {\n        JWTSVIDRequest.Builder proto = JWTSVIDRequest.newBuilder();\n        proto.addAllAudience(audiences);\n        Buffer payload = Buffer.buffer(proto.build().toByteArray());\n\n        return Multi.createFrom().emitter(emitter -> client.request(server)","sourceCodeStart":138,"sourceCodeEnd":174,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L138-L174","documentation":"SpiffeClientImpl.getWorkloadJsonWebToken requires a non-empty set of audiences because the SPIRE workload API needs at least one audience to include in the JWT-SVID. An empty (or null) audience set is rejected immediately with IllegalArgumentException before any gRPC call is made. This is an input-validation failure on the caller's side, not a SPIRE agent problem.","triggerScenarios":"Calling getWorkloadJsonWebToken(Set.of()) or getWorkloadJsonWebToken(new HashSet<>()); calling it with a dynamically built Set that was filtered down to empty (e.g. removing audiences that are null/blank beforehand).","commonSituations":"Config-driven audience lists that resolved to nothing (blank quarkus.spiffe config, missing OIDC audience property); iterating configured audiences where all entries were filtered out; a refactoring that changed a default audience value to empty.","solutions":["Pass at least one non-blank audience string, e.g. getWorkloadJsonWebToken(Set.of(\"https://my-service\"))","Check the source of the audience set (config property, OIDC token audience config) and fix the empty value","Guard the call site: skip or fail fast with a clear message when the set is empty"],"exampleFix":"// before\nUni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken(Set.of());\n// after\nUni<WorkloadJsonWebToken> token = spiffeClient.getWorkloadJsonWebToken(Set.of(\"https://api.example.com\"));","handlingStrategy":"validation","validationCode":"if (audiences == null || audiences.isEmpty()) {\n    throw new IllegalArgumentException(\"At least one audience is required\");\n}\nif (audiences.stream().anyMatch(a -> a == null || a.isBlank())) {\n    throw new IllegalArgumentException(\"Audiences must be non-blank strings\");\n}","typeGuard":null,"tryCatchPattern":null,"preventionTips":["Centralize audience constants instead of building sets ad hoc","Validate configuration-derived audience lists at startup","Fail fast with a clear message when a filter would empty the audience set"],"tags":["spiffe","validation","argument"],"backgroundTag":"empty-required-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}