{"record":{"id":"674655656a458c52","repo":"quarkusio/quarkus","slug":"spiffe-id-exceeds-maximum-length-of-2048-bytes","errorCode":null,"errorMessage":"SPIFFE ID exceeds maximum length of 2048 bytes: ${length}","messagePattern":"SPIFFE ID exceeds maximum length of 2048 bytes: (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":71,"sourceCode":"        }\n        // X.509-SVID 3.2 MUST: if signing cert has a SPIFFE ID, it must not have a path component\n        String uriSan = extractOptionalUriSan(cert);\n        if (uriSan != null && uriSan.startsWith(SPIFFE_URI_PREFIX)) {\n            URI uri = URI.create(uriSan);\n            String path = uri.getPath();\n            if (path != null && !path.isEmpty() && !\"/\".equals(path)) {\n                throw new SpiffeConnectionException(\n                        \"Signing certificate SPIFFE ID must not have a path component: \" + uriSan);\n            }\n        }\n    }\n\n    static void validateSpiffeId(String spiffeId) throws SpiffeConnectionException {\n        if (spiffeId == null || spiffeId.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not be empty\");\n        }\n        if (spiffeId.length() > MAX_SPIFFE_ID_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID exceeds maximum length of \" + MAX_SPIFFE_ID_LENGTH\n                    + \" bytes: \" + spiffeId.length());\n        }\n\n        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {","sourceCodeStart":53,"sourceCodeEnd":89,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L53-L89","documentation":"SPIFFE IDs are URIs whose serialized form must not exceed 2048 bytes (RFC 3986 limit enforced by the SPIFFE spec). SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when the supplied ID's length exceeds MAX_SPIFFE_ID_LENGTH (2048).","triggerScenarios":"Calling validateSpiffeId (directly or through connection setup) with a spiffe:// string longer than 2048 characters — usually because the path segment encodes huge or unbounded data (tokens, long tenant/ns/sa names concatenated).","commonSituations":"Templated identity paths that embed UUIDs + metadata repeatedly; misconfigured identity template loops appending segments; generated IDs containing base64 blobs.","solutions":["Shorten the SPIFFE ID path to meaningful segments (trust-domain + namespace + service account).","Fix the ID-generation template so it no longer appends unbounded data.","Validate length at the boundary where the ID is constructed, before handing it to the client."],"exampleFix":"// before\nString id = \"spiffe://example.org/ns/\" + ns + \"/sa/\" + sa + \"/token/\" + hugeJwt;\n// after\nString id = \"spiffe://example.org/ns/\" + ns + \"/sa/\" + sa;","handlingStrategy":"validation","validationCode":"if (spiffeId.length() > 2048) {\n    throw new IllegalStateException(\"SPIFFE ID exceeds 2048 bytes: \" + spiffeId.length());\n}","typeGuard":null,"tryCatchPattern":"try {\n    connection.establish();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"maximum length\")) {\n        log.error(\"SPIFFE ID too long; shorten identity path\", e);\n    }\n    throw e;\n}","preventionTips":["Keep SPIFFE ID paths short: trust-domain + namespace + service account","Never embed tokens or blobs in identity paths","Cap path-segment lengths in ID-generation code"],"tags":["spiffe","validation","uri"],"backgroundTag":"spiffe-id-validation-failed","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}