{"record":{"id":"8b821a0ea299f2c8","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-contain-a-fragment","errorCode":null,"errorMessage":"SPIFFE ID must not contain a fragment: ","messagePattern":"SPIFFE ID must not contain a fragment: ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":99,"sourceCode":"\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);\n            if (!isValidTrustDomainChar(c)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID trust domain contains invalid character '\" + c + \"': \" + spiffeId);\n            }\n        }\n","sourceCodeStart":81,"sourceCodeEnd":117,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L81-L117","documentation":"SPIFFE IDs may not contain a fragment (anything after '#'). SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when URI.getFragment() != null, because the SPIFFE spec defines the ID strictly as scheme://trust-domain/path.","triggerScenarios":"Passing an ID such as spiffe://example.org/sa/app#section to validateSpiffeId, or a certificate URI SAN containing a '#' fragment.","commonSituations":"Reusing HTML/doc URLs as identity strings; copy-paste carrying an anchor '#...' from documentation or issue trackers into config.","solutions":["Remove the '#fragment' portion of the ID","If the fragment carries meaning, encode it as additional path segments instead","Sanitize the source (config value, template, or SAN generator) that appends fragments"],"exampleFix":"// before\nString spiffeId = \"spiffe://example.org/sa/app#prod\";\n// after\nString spiffeId = \"spiffe://example.org/ns/prod/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean hasNoFragment(String id) {\n    try { return URI.create(id).getFragment() == null; }\n    catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { log.warnf(\"Fragment in SPIFFE ID: %s\", id); }","preventionTips":["Trim everything from '#' when copying IDs from docs/HTML sources","Never reuse web page URLs as workload identities"],"tags":["spiffe","validation","uri","spiffe-id"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}