quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID path must not contain dot segments:

Error message

SPIFFE ID path must not contain dot segments: 

What it means

SPIFFE ID path segments must not be '.' or '..', which are relative-navigation segments and forbidden by the SPIFFE spec to prevent path-traversal ambiguity. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when any path segment equals '.' or '..'.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:133

            }
        }

        String path = uri.getPath();
        if (path == null || path.isEmpty() || "/".equals(path)) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-root path: " + spiffeId);
        }
        if (path.endsWith("/")) {
            throw new SpiffeConnectionException("SPIFFE ID path must not have a trailing slash: " + spiffeId);
        }
        String[] segments = path.split("/", -1);
        for (int i = 1; i < segments.length; i++) {
            String segment = segments[i];
            if (segment.isEmpty()) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain empty segments: " + spiffeId);
            }
            if (".".equals(segment) || "..".equals(segment)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain dot segments: " + spiffeId);
            }
            for (int j = 0; j < segment.length(); j++) {
                char c = segment.charAt(j);
                if (!isValidPathChar(c)) {
                    throw new SpiffeConnectionException(
                            "SPIFFE ID path contains invalid character '" + c + "': " + spiffeId);
                }
            }
        }
    }

    private static String extractOptionalUriSan(X509Certificate cert) {
        try {
            var sans = cert.getSubjectAlternativeNames();
            if (sans == null) {
                return null;
            }

View on GitHub (pinned to e1c734241f)

Solutions

1. Remove '.'/'..' segments and express the final workload path directly
2. Normalize relative paths before converting them into a SPIFFE ID path
3. Fix the path-building code so components are absolute, explicit workload identifiers

Example fix

// before
String spiffeId = "spiffe://example.org/ns/" + ns + "/../sa/app";
// after
String spiffeId = "spiffe://example.org/ns/" + ns + "/sa/app";

static boolean noDotSegments(String id) {
    try {
        String p = URI.create(id).getPath();
        if (p == null) return false;
        for (String s : p.split("/")) {
            if (s.equals(".") || s.equals("..")) return false;
        }
        return true;
    } catch (IllegalArgumentException e) { return false; }
}

try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { throw new IllegalArgumentException("SPIFFE ID path must not contain '.' or '..'", e); }

When it happens

Trigger: validateSpiffeId called with IDs like 'spiffe://example.org/ns/../sa/app' or IDs produced by relative path resolution (e.g. Paths.get(...).resolve("..")).

Common situations: Building IDs from filesystem-style relative paths that were not normalized; templating that substitutes empty/relative components into segment positions; URL-resolving a base ID with '../' segments.

Related errors

• SPIFFE ID must have a non-root path:
• SPIFFE ID path must not have a trailing slash:
• SPIFFE ID path must not contain empty segments:
• SPIFFE ID must not contain a port: ${spiffeId}
• SPIFFE ID must not contain a query:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/28abf81223a27cd0. Report an issue: GitHub.