{"record":{"id":"bc052a9583223165","repo":"quarkusio/quarkus","slug":"jwt-svid-from-spire-agent-is-not-a-valid-jws-compa","errorCode":null,"errorMessage":"JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization","messagePattern":"JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":224,"sourceCode":"                                                emitter.fail(e);\n                                            } catch (Exception e) {\n                                                emitter.fail(new SpiffeConnectionException(\n                                                        \"Failed to parse response from SPIRE agent\", e));\n                                            }\n                                        });\n                            });\n                }));\n    }\n\n    private static WorkloadJsonWebToken toWorkloadJsonWebToken(JWTSVID svid,\n            Set<String> requestedAudiences) throws SpiffeConnectionException {\n        String token = svid.getSvid();\n        if (token.isBlank()) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent has no token\");\n        }\n        String[] parts = token.split(\"\\\\.\");\n        if (parts.length != 3) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization\");\n        }\n        JsonObject payload = new JsonObject(new String(Base64.getUrlDecoder().decode(parts[1])));\n\n        String sub = payload.getString(\"sub\");\n        SpiffeValidator.validateSpiffeId(sub);\n        if (!sub.equals(svid.getSpiffeId())) {\n            throw new SpiffeConnectionException(\n                    \"JWT-SVID proto SPIFFE ID does not match the 'sub' claim; proto: \" + svid.getSpiffeId() + \", sub: \" + sub);\n        }\n\n        Object aud = payload.getValue(\"aud\");\n        if (aud == null) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is missing the required 'aud' claim\");\n        }\n        final Set<String> audience;\n        if (aud instanceof JsonArray audienceAsArray) {\n            audience = new HashSet<>(audienceAsArray.size());\n            for (int i = 0; i < audienceAsArray.size(); i++) {","sourceCodeStart":206,"sourceCodeEnd":242,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L206-L242","documentation":"The client validates that the JWT-SVID is a JWS Compact Serialization with exactly three dot-separated parts (header.payload.signature). A token with the wrong shape cannot be parsed or verified. SpiffeConnectionException is thrown to avoid processing an invalid token.","triggerScenarios":"The SPIRE agent returned a token that is not a standard JWS (e.g. a JWE with 5 parts, a truncated/garbled string, or an error message instead of a token).","commonSituations":"Version mismatch between client expectations and SPIRE agent output; a proxy intercepting the Workload API and returning non-token data; manual corruption when copying token through test stubs.","solutions":["Ensure the SPIRE agent is a genuine, current agent and the workload connects directly to it (no mangled proxying)","Log the received token (first characters only) to diagnose its shape and compare with spire-agent api fetch jwt output","Upgrade quarkus-spiffe-client and SPIRE agent to compatible versions"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":"static boolean looksLikeJws(String token) {\n    return token != null && token.split(\"\\\\.\").length == 3;\n}","tryCatchPattern":"try {\n    return spiffeClient.getWorkloadJsonWebToken(audiences).await().indefinitely();\n} catch (SpiffeConnectionException e) {\n    if (e.getMessage().contains(\"JWS Compact Serialization\")) {\n        // re-fetch / upgrade agent; do not retry blindly\n    }\n    throw e;\n}","preventionTips":["Connect directly to the SPIRE agent socket, avoiding mangling proxies","Keep SPIRE agent and quarkus-spiffe-client versions compatible","Never manually construct or edit JWT-SVIDs"],"tags":["spiffe","jwt","malformed-token"],"backgroundTag":"malformed-jwt","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}