{"record":{"id":"d8da1ac1ffdd104a","repo":"quarkusio/quarkus","slug":"spiffe-id-must-not-contain-a-query","errorCode":null,"errorMessage":"SPIFFE ID must not contain a query: ","messagePattern":"SPIFFE ID must not contain a query: ","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java","lineNumber":96,"sourceCode":"        if (spiffeId.contains(\"%\")) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain percent-encoded characters: \" + spiffeId);\n        }\n\n        URI uri;\n        try {\n            uri = URI.create(spiffeId);\n        } catch (IllegalArgumentException e) {\n            throw new SpiffeConnectionException(\"SPIFFE ID is not a valid URI: \" + spiffeId, e);\n        }\n\n        if (uri.getUserInfo() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain userinfo: \" + spiffeId);\n        }\n        if (uri.getPort() != -1) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a port: \" + spiffeId);\n        }\n        if (uri.getQuery() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a query: \" + spiffeId);\n        }\n        if (uri.getFragment() != null) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must not contain a fragment: \" + spiffeId);\n        }\n\n        String trustDomain = uri.getHost();\n        if (trustDomain == null || trustDomain.isEmpty()) {\n            throw new SpiffeConnectionException(\"SPIFFE ID must have a non-empty trust domain: \" + spiffeId);\n        }\n        if (trustDomain.length() > MAX_TRUST_DOMAIN_LENGTH) {\n            throw new SpiffeConnectionException(\"SPIFFE ID trust domain exceeds maximum length of \"\n                    + MAX_TRUST_DOMAIN_LENGTH + \" bytes: \" + spiffeId);\n        }\n        for (int i = 0; i < trustDomain.length(); i++) {\n            char c = trustDomain.charAt(i);\n            if (!isValidTrustDomainChar(c)) {\n                throw new SpiffeConnectionException(\n                        \"SPIFFE ID trust domain contains invalid character '\" + c + \"': \" + spiffeId);","sourceCodeStart":78,"sourceCodeEnd":114,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java#L78-L114","documentation":"SPIFFE IDs are plain URIs of the form spiffe://trust-domain/path and may not carry a query string. SpiffeValidator.validateSpiffeId rejects any ID whose URI has a query component (anything after '?'), throwing SpiffeConnectionException.","triggerScenarios":"Calling validateSpiffeId with an ID like spiffe://example.org/service?env=prod, or supplying a certificate whose URI SAN includes query parameters.","commonSituations":"Building SPIFFE IDs from template URLs that already contain query strings; concatenating '?param=value' metadata onto IDs; tooling that serializes full request URLs as workload identities.","solutions":["Strip everything from '?' onward and use only spiffe://<trust-domain>/<path>","Move environment/metadata into the path segments (e.g. /ns/prod/sa/app) instead of query params","Fix the certificate issuance/registration template that generates the URI SAN"],"exampleFix":"// before\nString spiffeId = \"spiffe://example.org/sa/app?env=prod\";\n// after\nString spiffeId = \"spiffe://example.org/ns/prod/sa/app\";","handlingStrategy":"validation","validationCode":"static boolean hasNoQuery(String id) {\n    try { return URI.create(id).getQuery() == null; }\n    catch (IllegalArgumentException e) { return false; }\n}","typeGuard":null,"tryCatchPattern":"try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalArgumentException(\"SPIFFE ID must not contain '?'\", e); }","preventionTips":["Encode metadata as path segments, never query parameters","Strip query strings when deriving IDs from URLs","Review templates that interpolate full URLs into ID fields"],"tags":["spiffe","validation","uri","spiffe-id"],"backgroundTag":"spiffe-id-validation","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}