{"record":{"id":"21b03b1abfc29a91","repo":"quarkusio/quarkus","slug":"spiffe-id-must-have-a-non-empty-trust-domain","errorCode":null,"errorMessage":"SPIFFE ID must have a non-empty trust domain: ","messagePattern":"SPIFFE ID must have a non-empty trust domain: ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":104,"sourceCode":"            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);\n            if (!isValidTrustDomainChar(c)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID trust domain contains invalid character '\" + c + \"': \" + spiffeId);\n            }\n        }\n\n        String path = uri.getPath();\n        if (path == null || path.isEmpty() || \"/\".equals(path)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-root path: \" + spiffeId);\n        }\n        if (path.endsWith(\"/\")) {","sourceCodeStart":86,"sourceCodeEnd":122,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L86-L122","documentation":"A SPIFFE ID must have a non-empty trust domain immediately after 'spiffe://'. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when URI.getHost() is null or empty (e.g. 'spiffe://' or 'spiffe:///path').","triggerScenarios":"Calling validateSpiffeId with 'spiffe://' alone, 'spiffe:///ns/default', or an ID where the host portion failed to parse due to invalid characters.","commonSituations":"Empty or placeholder trust-domain config values; string concatenation like \"spiffe://\" + trustDomain where trustDomain is blank/unset; IDs assembled after a config migration where the trust domain property was dropped.","solutions":["Set a valid trust domain, e.g. spiffe://example.org/ns/default/sa/app","Check the quarkus SPIFFE config for an empty/unset trust-domain property","Guard string-built IDs so a missing trust domain fails before validation"],"exampleFix":"// before\nString spiffeId = \"spiffe:///ns/default/sa/app\"; // trust domain missing\n// after\nString spiffeId = \"spiffe://example.org/ns/default/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean hasTrustDomain(String id) {\n    try {\n        URI u = URI.create(id);\n        return u.getHost() != null && !u.getHost().isEmpty();\n    } catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalStateException(\"Trust domain missing in SPIFFE ID config\", e); }","preventionTips":["Fail fast on empty trust-domain config properties at startup","Never string-concatenate 'spiffe://' with a possibly-blank variable without a null/empty check"],"tags":["spiffe","validation","trust-domain","spiffe-id"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}