{"record":{"id":"effedb501b0339ac","repo":"quarkusio/quarkus","slug":"audience-must-not-contain-spaces-audience","errorCode":null,"errorMessage":"Audience must not contain spaces: '${audience}'","messagePattern":"Audience must not contain spaces: '(.+?)'","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":432,"sourceCode":"        if (\"unix\".equals(uri.getScheme())) {\n            if (OS.WINDOWS.isCurrent()) {\n                throw new ConfigurationException(\n                        \"The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.\");\n            }\n            return SocketAddress.domainSocketAddress(uri.getPath());\n        }\n        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());\n    }\n\n    private static void validateAudience(String audience) {\n        if (audience == null) {\n            throw new IllegalArgumentException(\"Audience must not be null\");\n        }\n        if (audience.isBlank()) {\n            throw new IllegalArgumentException(\"Audience must not be blank\");\n        }\n        if (audience.indexOf(' ') >= 0) {\n            throw new IllegalArgumentException(\"Audience must not contain spaces: '\" + audience + \"'\");\n        }\n    }\n}\n","sourceCodeStart":414,"sourceCodeEnd":436,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L414-L436","documentation":"Audiences in SPIFFE JWT-SVIDs are whitespace-delimited in the JWT aud claim, so an audience string containing an embedded space cannot be represented as a single audience. The library rejects it with IllegalArgumentException naming the offending value. Use multiple calls or separate audiences per the API contract instead of a space-separated string.","triggerScenarios":"Calling getWorkloadJsonWebToken(\"svc-a svc-b\", ...) or passing a config value with accidental whitespace, e.g. quarkus.spiffe.jwt.audience=my audience.","commonSituations":"Passing a space-separated list of services as one audience; copy-pasting 'aud1 aud2' from JWT documentation; accidental extra whitespace in a configured audience value.","solutions":["Pass a single audience string without spaces; call the API once per audience if several are needed.","Trim and validate the configured value: reject any audience containing ' ' at startup.","Check for accidental spaces in application.properties or env var values.","Use a validation regex such as ^\\S+$ on the audience before invoking the client."],"exampleFix":"// before\nString token = client.getWorkloadJsonWebToken(\"svc-a svc-b\", ttl);\n// after\nString token = client.getWorkloadJsonWebToken(\"svc-a\", ttl);","handlingStrategy":"validation","validationCode":"if (audience == null || audience.isBlank() || audience.indexOf(' ') >= 0) {\n    throw new IllegalArgumentException(\"JWT audience must be a single token without spaces\");\n}","typeGuard":"static boolean isValidAudience(String audience) {\n    return audience != null && !audience.isBlank() && !audience.contains(\" \");\n}","tryCatchPattern":"try {\n    String token = client.getWorkloadJsonWebToken(audience, ttl);\n} catch (IllegalArgumentException e) {\n    log.error(\"Audience contains spaces: \" + e.getMessage());\n    throw new IllegalArgumentException(\"Use one audience per call\", e);\n}","preventionTips":["Validate with regex ^\\\\S+$ before calling","Do not join multiple audiences with spaces — call once per audience","Beware accidental whitespace in properties files","Add a config-level constraint (pattern) on the audience property"],"tags":["spiffe","jwt","audience","illegal-argument"],"backgroundTag":"missing-required-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}