{"record":{"id":"e36f0b9268ce2944","repo":"quarkusio/quarkus","slug":"jwt-svid-from-spire-agent-has-no-token","errorCode":null,"errorMessage":"JWT-SVID from SPIRE agent has no token","messagePattern":"JWT-SVID from SPIRE agent has no token","errorType":"exception","errorClass":"SpiffeConnectionException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":220,"sourceCode":"                                                    emitter.emit(toWorkloadJsonWebToken(svid, audiences));\n                                                }\n                                                emitter.complete();\n                                            } catch (SpiffeConnectionException e) {\n                                                emitter.fail(e);\n                                            } catch (Exception e) {\n                                                emitter.fail(new SpiffeConnectionException(\n                                                        \"Failed to parse response from SPIRE agent\", e));\n                                            }\n                                        });\n                            });\n                }));\n    }\n\n    private static WorkloadJsonWebToken toWorkloadJsonWebToken(JWTSVID svid,\n            Set<String> requestedAudiences) throws SpiffeConnectionException {\n        String token = svid.getSvid();\n        if (token.isBlank()) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent has no token\");\n        }\n        String[] parts = token.split(\"\\\\.\");\n        if (parts.length != 3) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization\");\n        }\n        JsonObject payload = new JsonObject(new String(Base64.getUrlDecoder().decode(parts[1])));\n\n        String sub = payload.getString(\"sub\");\n        SpiffeValidator.validateSpiffeId(sub);\n        if (!sub.equals(svid.getSpiffeId())) {\n            throw new SpiffeConnectionException(\n                    \"JWT-SVID proto SPIFFE ID does not match the 'sub' claim; proto: \" + svid.getSpiffeId() + \", sub: \" + sub);\n        }\n\n        Object aud = payload.getValue(\"aud\");\n        if (aud == null) {\n            throw new SpiffeConnectionException(\"JWT-SVID from SPIRE agent is missing the required 'aud' claim\");\n        }","sourceCodeStart":202,"sourceCodeEnd":238,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L202-L238","documentation":"The JWT-SVID returned by the SPIRE Workload API (JWTSVID proto) contained a null/blank svid string. The client parses the token to verify its claims, so an empty token is unusable and SpiffeConnectionException is thrown. This indicates the SPIRE agent returned a malformed or empty JWT-SVID entry.","triggerScenarios":"fetchWorkloadJsonWebTokens receives a JWTSVID whose getSvid() is null or whitespace; a SPIRE agent version returning an entry with only spiffe_id populated (e.g. during registration issues).","commonSituations":"Misregistered workload entry in SPIRE that has no JWT-SVID capable of being issued; SPIRE agent proxy/mesh returning placeholder entries; stale connection to an agent after restart.","solutions":["Verify the SPIRE workload registration entry exists and is valid (spire-server entry show) and restart/re-fetch the SVID","Check the SPIRE agent logs for JWT-SVID issuance errors; upgrade the agent if it returns empty svid fields","Retry fetching the token; if persistent, check socket/path config (quarkus.spiffe.* trust/agent socket) points at the correct agent"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"try {\n    WorkloadJsonWebToken t = spiffeClient.getWorkloadJsonWebToken(audiences)\n        .await().indefinitely();\n} catch (SpiffeConnectionException e) {\n    // log token-issuance failure, check SPIRE agent health, optionally retry once\n}","preventionTips":["Monitor SPIRE agent health/sockets before fetching tokens","Verify workload registration entries after any SPIRE config change","Retry transient failures with backoff before surfacing to callers"],"tags":["spiffe","jwt","spire","response-validation"],"backgroundTag":"empty-jwt-token","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}