quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID exceeds maximum length of 2048 bytes: ${length}

Error message

SPIFFE ID exceeds maximum length of 2048 bytes: ${length}

What it means

SPIFFE IDs are URIs whose serialized form must not exceed 2048 bytes (RFC 3986 limit enforced by the SPIFFE spec). SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when the supplied ID's length exceeds MAX_SPIFFE_ID_LENGTH (2048).

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:71

        }
        // X.509-SVID 3.2 MUST: if signing cert has a SPIFFE ID, it must not have a path component
        String uriSan = extractOptionalUriSan(cert);
        if (uriSan != null && uriSan.startsWith(SPIFFE_URI_PREFIX)) {
            URI uri = URI.create(uriSan);
            String path = uri.getPath();
            if (path != null && !path.isEmpty() && !"/".equals(path)) {
                throw new SpiffeConnectionException(
                        "Signing certificate SPIFFE ID must not have a path component: " + uriSan);
            }
        }
    }

    static void validateSpiffeId(String spiffeId) throws SpiffeConnectionException {
        if (spiffeId == null || spiffeId.isEmpty()) {
            throw new SpiffeConnectionException("SPIFFE ID must not be empty");
        }
        if (spiffeId.length() > MAX_SPIFFE_ID_LENGTH) {
            throw new SpiffeConnectionException("SPIFFE ID exceeds maximum length of " + MAX_SPIFFE_ID_LENGTH
                    + " bytes: " + spiffeId.length());
        }

        if (!spiffeId.startsWith(SPIFFE_URI_PREFIX)) {
            throw new SpiffeConnectionException("SPIFFE ID must have 'spiffe://' scheme: " + spiffeId);
        }
        if (spiffeId.contains("%")) {
            throw new SpiffeConnectionException("SPIFFE ID must not contain percent-encoded characters: " + spiffeId);
        }

        URI uri;
        try {
            uri = URI.create(spiffeId);
        } catch (IllegalArgumentException e) {
            throw new SpiffeConnectionException("SPIFFE ID is not a valid URI: " + spiffeId, e);
        }

        if (uri.getUserInfo() != null) {

View on GitHub (pinned to e1c734241f)

Solutions

1. Shorten the SPIFFE ID path to meaningful segments (trust-domain + namespace + service account).
2. Fix the ID-generation template so it no longer appends unbounded data.
3. Validate length at the boundary where the ID is constructed, before handing it to the client.

Example fix

// before
String id = "spiffe://example.org/ns/" + ns + "/sa/" + sa + "/token/" + hugeJwt;
// after
String id = "spiffe://example.org/ns/" + ns + "/sa/" + sa;

if (spiffeId.length() > 2048) {
    throw new IllegalStateException("SPIFFE ID exceeds 2048 bytes: " + spiffeId.length());
}

try {
    connection.establish();
} catch (SpiffeConnectionException e) {
    if (e.getMessage().contains("maximum length")) {
        log.error("SPIFFE ID too long; shorten identity path", e);
    }
    throw e;
}

When it happens

Trigger: Calling validateSpiffeId (directly or through connection setup) with a spiffe:// string longer than 2048 characters — usually because the path segment encodes huge or unbounded data (tokens, long tenant/ns/sa names concatenated).

Common situations: Templated identity paths that embed UUIDs + metadata repeatedly; misconfigured identity template loops appending segments; generated IDs containing base64 blobs.

Related errors

• SPIFFE ID must have 'spiffe://' scheme: ${spiffeId}
• SPIFFE ID is not a valid URI: ${spiffeId}
• SPIFFE ID must not contain userinfo: ${spiffeId}
• SPIFFE ID must not contain a port: ${spiffeId}
• SPIFFE ID must not contain a query:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/674655656a458c52. Report an issue: GitHub.