{"record":{"id":"fe7043553e5ed1ce","repo":"quarkusio/quarkus","slug":"audience-must-not-be-blank","errorCode":null,"errorMessage":"Audience must not be blank","messagePattern":"Audience must not be blank","errorType":"validation","errorClass":"IllegalArgumentException","httpStatus":null,"severity":"error","filePath":"extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java","lineNumber":429,"sourceCode":"    }\n\n    private static SocketAddress toSocketAddress(URI uri) {\n        if (\"unix\".equals(uri.getScheme())) {\n            if (OS.WINDOWS.isCurrent()) {\n                throw new ConfigurationException(\n                        \"The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.\");\n            }\n            return SocketAddress.domainSocketAddress(uri.getPath());\n        }\n        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());\n    }\n\n    private static void validateAudience(String audience) {\n        if (audience == null) {\n            throw new IllegalArgumentException(\"Audience must not be null\");\n        }\n        if (audience.isBlank()) {\n            throw new IllegalArgumentException(\"Audience must not be blank\");\n        }\n        if (audience.indexOf(' ') >= 0) {\n            throw new IllegalArgumentException(\"Audience must not contain spaces: '\" + audience + \"'\");\n        }\n    }\n}\n","sourceCodeStart":411,"sourceCodeEnd":436,"githubUrl":"https://github.com/quarkusio/quarkus/blob/e1c734241f34c7919086ceb4c9262b4a58f6de44/extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java#L411-L436","documentation":"Along with null, an audience that is present but blank (empty or whitespace-only) is rejected. A blank audience would produce a JWT whose aud claim is useless for the receiving service's validation, so the library fails fast with IllegalArgumentException. Like the null case, it indicates a caller/config error.","triggerScenarios":"Calling getWorkloadJsonWebToken(\"\", ...) or passing a value of \"   \" — commonly the result of an empty configuration property or trimming away all content of an env var.","commonSituations":"application.properties containing quarkus.spiffe.jwt.audience= (empty); an environment variable set but empty in Kubernetes manifests; over-eager sanitization stripping the audience.","solutions":["Provide a real audience value matching what the receiving service validates.","Add validation on config load: if (audience == null || audience.isBlank()) fail startup with a clear message.","If the value comes from an env var, check it is non-blank in the deployment manifest.","Write a unit test covering blank-audience configuration to catch this early."],"exampleFix":"// before\nString token = client.getWorkloadJsonWebToken(cfg.getAudience(), ttl);\n// after\nString audience = cfg.getAudience();\nif (audience == null || audience.isBlank()) {\n    throw new IllegalArgumentException(\"JWT audience must be a non-blank value\");\n}\nString token = client.getWorkloadJsonWebToken(audience, ttl);","handlingStrategy":"validation","validationCode":"if (audience == null || audience.isBlank()) {\n    throw new IllegalArgumentException(\"JWT audience must be non-blank\");\n}","typeGuard":"static boolean isValidAudience(String audience) {\n    return audience != null && !audience.isBlank();\n}","tryCatchPattern":"try {\n    String token = client.getWorkloadJsonWebToken(audience, ttl);\n} catch (IllegalArgumentException e) {\n    log.error(\"Blank audience rejected: \" + e.getMessage());\n    throw new IllegalArgumentException(\"Set a concrete JWT audience\", e);\n}","preventionTips":["Check for empty values in application.properties (trailing '=')","Verify Kubernetes env vars are actually populated","Trim user-supplied values but reject results that end up blank","Cover blank config values in config tests"],"tags":["spiffe","jwt","audience","illegal-argument"],"backgroundTag":"missing-required-argument","analyzedSha":"e1c734241f34c7919086ceb4c9262b4a58f6de44","analyzedAt":"2026-09-05T17:01:29.979Z","contentChangedAt":"2026-09-05T17:01:29.979Z","schemaVersion":2},"datasetVersion":"2026-09-12T22:17:10.623Z"}