quarkusio/quarkus · error · IllegalArgumentException

Audience must not contain spaces: '${audience}'

Error message

Audience must not contain spaces: '${audience}'

What it means

Audiences in SPIFFE JWT-SVIDs are whitespace-delimited in the JWT aud claim, so an audience string containing an embedded space cannot be represented as a single audience. The library rejects it with IllegalArgumentException naming the offending value. Use multiple calls or separate audiences per the API contract instead of a space-separated string.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:432

        if ("unix".equals(uri.getScheme())) {
            if (OS.WINDOWS.isCurrent()) {
                throw new ConfigurationException(
                        "The SPIFFE client extension does not support unix scheme on Windows, use tcp:// instead.");
            }
            return SocketAddress.domainSocketAddress(uri.getPath());
        }
        return SocketAddress.inetSocketAddress(uri.getPort(), uri.getHost());
    }

    private static void validateAudience(String audience) {
        if (audience == null) {
            throw new IllegalArgumentException("Audience must not be null");
        }
        if (audience.isBlank()) {
            throw new IllegalArgumentException("Audience must not be blank");
        }
        if (audience.indexOf(' ') >= 0) {
            throw new IllegalArgumentException("Audience must not contain spaces: '" + audience + "'");
        }
    }
}

View on GitHub (pinned to e1c734241f)

Solutions

1. Pass a single audience string without spaces; call the API once per audience if several are needed.
2. Trim and validate the configured value: reject any audience containing ' ' at startup.
3. Check for accidental spaces in application.properties or env var values.
4. Use a validation regex such as ^\S+$ on the audience before invoking the client.

Example fix

// before
String token = client.getWorkloadJsonWebToken("svc-a svc-b", ttl);
// after
String token = client.getWorkloadJsonWebToken("svc-a", ttl);

if (audience == null || audience.isBlank() || audience.indexOf(' ') >= 0) {
    throw new IllegalArgumentException("JWT audience must be a single token without spaces");
}

static boolean isValidAudience(String audience) {
    return audience != null && !audience.isBlank() && !audience.contains(" ");
}

try {
    String token = client.getWorkloadJsonWebToken(audience, ttl);
} catch (IllegalArgumentException e) {
    log.error("Audience contains spaces: " + e.getMessage());
    throw new IllegalArgumentException("Use one audience per call", e);
}

When it happens

Trigger: Calling getWorkloadJsonWebToken("svc-a svc-b", ...) or passing a config value with accidental whitespace, e.g. quarkus.spiffe.jwt.audience=my audience.

Common situations: Passing a space-separated list of services as one audience; copy-pasting 'aud1 aud2' from JWT documentation; accidental extra whitespace in a configured audience value.

Understand the failure class

Background: "missing required argument" and "the following required arguments were not provided": what required-argument errors mean and how to fix them — this error's family across 20 libraries.

Related errors

• Audience must not be null
• Audience must not be blank
• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi
• Audiences must not be null
• JWT-SVID from SPIRE agent has no token

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/effedb501b0339ac. Report an issue: GitHub.