{"record":{"id":"80d00bb1a5704a20","repo":"quarkusio/quarkus","slug":"spiffe-id-trust-domain-exceeds-maximum-length-of","errorCode":null,"errorMessage":"SPIFFE ID trust domain exceeds maximum length of  + MAX_TRUST_DOMAIN_LENGTH +  bytes: ","messagePattern":"SPIFFE ID trust domain exceeds maximum length of  \\+ MAX_TRUST_DOMAIN_LENGTH \\+  bytes: ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":107,"sourceCode":"        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);\n            if (!isValidTrustDomainChar(c)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID trust domain contains invalid character '\" + c + \"': \" + spiffeId);\n            }\n        }\n\n        String path = uri.getPath();\n        if (path == null || path.isEmpty() || \"/\".equals(path)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-root path: \" + spiffeId);\n        }\n        if (path.endsWith(\"/\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID path must not have a trailing slash: \" + spiffeId);\n        }\n        String[] segments = path.split(\"/\", -1);","sourceCodeStart":89,"sourceCodeEnd":125,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L89-L125","documentation":"Thrown by SpiffeValidator.validateSpiffeId when the trust domain portion of a parsed SPIFFE ID URI (spiffe://trust-domain/...) exceeds MAX_TRUST_DOMAIN_LENGTH bytes. SPIFFE IDs are length-limited by specification; a longer trust domain would produce non-compliant SVIDs/workload identities, so the syntactic validation chain (which also rejects userinfo, ports, queries and fragments) rejects it with the offending id appended.","triggerScenarios":"validateSpiffeId invoked with an ID whose trust domain is longer than 255 chars, e.g. an over-long DNS-like domain or an accidentally concatenated domain string.","commonSituations":"Test/dev environments using machine-generated ultra-long domains; string-building bugs that duplicate or append suffixes to the domain; multi-tenancy setups encoding tenant info into very long domain names.","solutions":["Shorten the trust domain to 255 characters or fewer","Move extra identifying detail into the path (e.g. /tenant/x/sa/app)","Check for string-concatenation bugs duplicating the domain in the ID builder"],"exampleFix":"// before\nString id = \"spiffe://\" + org + \".\" + env + \".\" + region + \".very-long-...\" + \"/sa/app\"; // >255 chars\n// after\nString id = \"spiffe://org-env.\" + region + \"/tenant/\" + org + \"/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean trustDomainWithinLimit(String id) {\n    try {\n        String host = URI.create(id).getHost();\n        return host != null && host.length() <= 255;\n    } catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { log.errorf(\"Trust domain too long: %s\", e.getMessage()); }","preventionTips":["Keep trust domains short; put extra scoping detail in the path","Assert domain length in config tests"],"tags":["spiffe","validation","trust-domain","length-limit"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}