{"record":{"id":"b1e5aa3dfc65643f","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-contain-a-port-spiffeid","errorCode":null,"errorMessage":"SPIFFE ID must not contain a port: ${spiffeId}","messagePattern":"SPIFFE ID must not contain a port: (.+?)","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":93,"sourceCode":"        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have 'spiffe://' scheme: \" + spiffeId);\n        }\n        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);","sourceCodeStart":75,"sourceCodeEnd":111,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L75-L111","documentation":"The Quarkus SPIFFE client validates every SPIFFE ID against the SPIFFE standard (spiffe://<trust-domain>/<path>) and rejects any URI containing components outside the scheme/host/path form. A port in the authority (e.g. spiffe://trustdomain:8443/ns/default) is not permitted, so SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when URI.getPort() != -1.","triggerScenarios":"Passing a SPIFFE ID string containing ':<port>' after the trust domain to validateSpiffeId, or configuring a workload endpoint/certificate whose URI SAN embeds a port (e.g. spiffe://example.org:8080/service).","commonSituations":"Copy-pasting an HTTPS endpoint URL style into a SPIFFE ID field; hand-writing SPIFFE IDs with cluster agent ports appended; workloads registered with a SPIFFE ID generated from a full server URL including :8443/:443.","solutions":["Remove the ':port' suffix so the ID is spiffe://<trust-domain>/<path>","Keep connection endpoints (host:port) in the connection config, not in the SPIFFE ID itself","Fix the registration entry in the SPIRE/workload registrar so its SPIFFE ID SAN has no port","Pre-validate IDs with URI.create(id).getPort() == -1 before use"],"exampleFix":"// before\nString spiffeId = \"spiffe://example.org:8443/ns/default/sa/app\";\n// after\nString spiffeId = \"spiffe://example.org/ns/default/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean hasNoPort(String id) {\n    try { return id.startsWith(\"spiffe://\") && URI.create(id).getPort() == -1; }\n    catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { log.errorf(\"Invalid SPIFFE ID %s: %s\", id, e.getMessage()); }","preventionTips":["Never embed host:port endpoint strings in SPIFFE ID fields","Keep ports in connection configuration, not identity strings","Add a unit test asserting URI.create(id).getPort() == -1 for all configured IDs"],"tags":["spiffe","validation","uri","spiffe-id"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}