quarkusio/quarkus · error · IllegalArgumentException

Audience must not be blank

Error message

Audience must not be blank

What it means

Along with null, an audience that is present but blank (empty or whitespace-only) is rejected. A blank audience would produce a JWT whose aud claim is useless for the receiving service's validation, so the library fails fast with IllegalArgumentException. Like the null case, it indicates a caller/config error.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:429

    }

    private static SocketAddress toSocketAddress(URI uri) {
        if ("unix".equals(uri.getScheme())) {
            if (OS.WINDOWS.isCurrent()) {
                throw new ConfigurationException(
                        "The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.");
            }
            return SocketAddress.domainSocketAddress(uri.getPath());
        }
        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());
    }

    private static void validateAudience(String audience) {
        if (audience == null) {
            throw new IllegalArgumentException("Audience must not be null");
        }
        if (audience.isBlank()) {
            throw new IllegalArgumentException("Audience must not be blank");
        }
        if (audience.indexOf(' ') >= 0) {
            throw new IllegalArgumentException("Audience must not contain spaces: '" + audience + "'");
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Provide a real audience value matching what the receiving service validates.
2. Add validation on config load: if (audience == null || audience.isBlank()) fail startup with a clear message.
3. If the value comes from an env var, check it is non-blank in the deployment manifest.
4. Write a unit test covering blank-audience configuration to catch this early.

Example fix

// before
String token = client.getWorkloadJsonWebToken(cfg.getAudience(), ttl);
// after
String audience = cfg.getAudience();
if (audience == null || audience.isBlank()) {
    throw new IllegalArgumentException("JWT audience must be a non-blank value");
}
String token = client.getWorkloadJsonWebToken(audience, ttl);

if (audience == null || audience.isBlank()) {
    throw new IllegalArgumentException("JWT audience must be non-blank");
}

static boolean isValidAudience(String audience) {
    return audience != null && !audience.isBlank();
}

try {
    String token = client.getWorkloadJsonWebToken(audience, ttl);
} catch (IllegalArgumentException e) {
    log.error("Blank audience rejected: " + e.getMessage());
    throw new IllegalArgumentException("Set a concrete JWT audience", e);
}

When it happens

Trigger: Calling getWorkloadJsonWebToken("", ...) or passing a value of " " — commonly the result of an empty configuration property or trimming away all content of an env var.

Common situations: application.properties containing quarkus.spiffe.jwt.audience= (empty); an environment variable set but empty in Kubernetes manifests; over-eager sanitization stripping the audience.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Audience must not be null
• Audience must not contain spaces: '${audience}'
• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi
• Audiences must not be null
• JWT-SVID from SPIRE agent has no token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/fe7043553e5ed1ce. Report an issue: GitHub.