{"record":{"id":"bb61fdcdde898cb0","repo":"quarkusio/quarkus","slug":"audience-must-not-be-null","errorCode":null,"errorMessage":"Audience must not be null","messagePattern":"Audience must not be null","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":426,"sourceCode":"            return new SpiffeAuthorizationException(detail);\n        }\n        return new SpiffeConnectionException(detail);\n    }\n\n    private static SocketAddress toSocketAddress(URI uri) {\n        if (\"unix\".equals(uri.getScheme())) {\n            if (OS.WINDOWS.isCurrent()) {\n                throw new ConfigurationException(\n                        \"The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.\");\n            }\n            return SocketAddress.domainSocketAddress(uri.getPath());\n        }\n        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());\n    }\n\n    private static void validateAudience(String audience) {\n        if (audience == null) {\n            throw new IllegalArgumentException(\"Audience must not be null\");\n        }\n        if (audience.isBlank()) {\n            throw new IllegalArgumentException(\"Audience must not be blank\");\n        }\n        if (audience.indexOf(' ') >= 0) {\n            throw new IllegalArgumentException(\"Audience must not contain spaces: '\" + audience + \"'\");\n        }\n    }\n}\n","sourceCodeStart":408,"sourceCodeEnd":436,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L408-L436","documentation":"Requesting a SPIFFE Workload API JWT-SVID requires an audience string that identifies the intended consumers of the token. The library validates the audience argument up front and throws IllegalArgumentException when null is passed, because a JWT without audiences cannot be meaningfully scoped. This is a caller programming error, not a runtime/network issue.","triggerScenarios":"Calling getWorkloadJsonWebToken(null, ...) or any API where the audience parameter is null, often because the value comes from unpopulated configuration (a missing config property resolved to null).","commonSituations":"Forgetting to set the JWT audience in application.properties; reading a config property that is absent and passing it through unchecked; refactoring call sites and dropping the argument.","solutions":["Pass a concrete audience string, e.g. getWorkloadJsonWebToken(\"my-service\", ...) as expected by the downstream validator.","Add the audience to configuration and read it with a default/failure: quarkus.spiffe.jwt.audience.","Null-check configuration values before calling and fail fast with a clear message.","Use Objects.requireNonNull(audience, ...) at your own API boundary to catch regressions in tests."],"exampleFix":"// before\nString token = client.getWorkloadJsonWebToken(config.audience(), ttl);\n// after\nString token = client.getWorkloadJsonWebToken(Objects.requireNonNull(config.audience(), \"JWT audience must be configured\"), ttl);","handlingStrategy":"validation","validationCode":"if (audience == null) {\n    throw new IllegalArgumentException(\"JWT audience must be configured and non-null\");\n}","typeGuard":"static boolean hasAudience(String audience) {\n    return audience != null && !audience.isBlank();\n}","tryCatchPattern":"try {\n    String token = client.getWorkloadJsonWebToken(audience, ttl);\n} catch (IllegalArgumentException e) {\n    log.error(\"Audience parameter invalid: \" + e.getMessage());\n    throw new IllegalArgumentException(\"Provide a valid JWT audience\", e);\n}","preventionTips":["Make the JWT audience a required config property","Use Objects.requireNonNull at your API boundary","Add startup-time config validation","Unit-test the call site with a null audience to catch regressions"],"tags":["spiffe","jwt","audience","illegal-argument"],"backgroundTag":"missing-required-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-14T00:17:10.932Z"}