quarkusio/quarkus · error · SpiffeConnectionException

JWT-SVID from SPIRE agent is not a valid JWS Compact Seriali

Error message

JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization

What it means

The client validates that the JWT-SVID is a JWS Compact Serialization with exactly three dot-separated parts (header.payload.signature). A token with the wrong shape cannot be parsed or verified. SpiffeConnectionException is thrown to avoid processing an invalid token.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeClientImpl.java:224

                                                emitter.fail(e);
                                            } catch (Exception e) {
                                                emitter.fail(new SpiffeConnectionException(
                                                        "Failed to parse response from SPIRE agent", e));
                                            }
                                        });
                            });
                }));
    }

    private static WorkloadJsonWebToken toWorkloadJsonWebToken(JWTSVID svid,
            Set<String> requestedAudiences) throws SpiffeConnectionException {
        String token = svid.getSvid();
        if (token.isBlank()) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent has no token");
        }
        String[] parts = token.split("\\.");
        if (parts.length != 3) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is not a valid JWS Compact Serialization");
        }
        JsonObject payload = new JsonObject(new String(Base64.getUrlDecoder().decode(parts[1])));

        String sub = payload.getString("sub");
        SpiffeValidator.validateSpiffeId(sub);
        if (!sub.equals(svid.getSpiffeId())) {
            throw new SpiffeConnectionException(
                    "JWT-SVID proto SPIFFE ID does not match the 'sub' claim; proto: " + svid.getSpiffeId() + ", sub: " + sub);
        }

        Object aud = payload.getValue("aud");
        if (aud == null) {
            throw new SpiffeConnectionException("JWT-SVID from SPIRE agent is missing the required 'aud' claim");
        }
        final Set<String> audience;
        if (aud instanceof JsonArray audienceAsArray) {
            audience = new HashSet<>(audienceAsArray.size());
            for (int i = 0; i < audienceAsArray.size(); i++) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Ensure the SPIRE agent is a genuine, current agent and the workload connects directly to it (no mangled proxying)
2. Log the received token (first characters only) to diagnose its shape and compare with spire-agent api fetch jwt output
3. Upgrade quarkus-spiffe-client and SPIRE agent to compatible versions

static boolean looksLikeJws(String token) {
    return token != null && token.split("\\.").length == 3;
}

try {
    return spiffeClient.getWorkloadJsonWebToken(audiences).await().indefinitely();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("JWS Compact Serialization")) {
        // re-fetch / upgrade agent; do not retry blindly
    }
    throw e;
}

When it happens

Trigger: The SPIRE agent returned a token that is not a standard JWS (e.g. a JWE with 5 parts, a truncated/garbled string, or an error message instead of a token).

Common situations: Version mismatch between client expectations and SPIRE agent output; a proxy intercepting the Workload API and returning non-token data; manual corruption when copying token through test stubs.

Related errors

• 'credentials.jwt.source' is set to 'spiffe-jwt', but no audi
• JWT-SVID from SPIRE agent has no token
• JWT-SVID proto SPIFFE ID does not match the 'sub' claim; pro
• JWT-SVID from SPIRE agent is missing the required 'aud' clai
• JWT-SVID 'aud' array element at index ${i} is not a string:$

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/bc052a9583223165. Report an issue: GitHub.