quarkusio/quarkus · error · SpiffeConnectionException

SPIFFE ID path must not contain empty segments:

Error message

SPIFFE ID path must not contain empty segments: 

What it means

SPIFFE ID paths must not contain empty segments, i.e. consecutive slashes or a leading double slash. SpiffeValidator.validateSpiffeId throws SpiffeConnectionException when splitting the path on '/' yields an empty segment.

Source

Thrown at extensions/spiffe-client/runtime/src/main/java/io/quarkus/spiffe/client/runtime/internal/SpiffeValidator.java:129

            char c = trustDomain.charAt(i);
            if (!isValidTrustDomainChar(c)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID trust domain contains invalid character '" + c + "': " + spiffeId);
            }
        }

        String path = uri.getPath();
        if (path == null || path.isEmpty() || "/".equals(path)) {
            throw new SpiffeConnectionException("SPIFFE ID must have a non-root path: " + spiffeId);
        }
        if (path.endsWith("/")) {
            throw new SpiffeConnectionException("SPIFFE ID path must not have a trailing slash: " + spiffeId);
        }
        String[] segments = path.split("/", -1);
        for (int i = 1; i < segments.length; i++) {
            String segment = segments[i];
            if (segment.isEmpty()) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain empty segments: " + spiffeId);
            }
            if (".".equals(segment) || "..".equals(segment)) {
                throw new SpiffeConnectionException(
                        "SPIFFE ID path must not contain dot segments: " + spiffeId);
            }
            for (int j = 0; j < segment.length(); j++) {
                char c = segment.charAt(j);
                if (!isValidPathChar(c)) {
                    throw new SpiffeConnectionException(
                            "SPIFFE ID path contains invalid character '" + c + "': " + spiffeId);
                }
            }
        }
    }

    private static String extractOptionalUriSan(X509Certificate cert) {
        try {

View on GitHub (pinned to e1c734241f)

Solutions

1. Collapse duplicate '/' separators so each path segment is non-empty
2. Normalize before building: path.replaceAll("/+", "/") on the path portion
3. Fix the string-concatenation/template producing the doubled slash

Example fix

// before
String spiffeId = domain + "/" + namespace + "/" + sa; // domain already ends with '/'
// after
String spiffeId = (domain.endsWith("/") ? domain : domain + "/") + namespace + "/" + sa;

static String collapseSlashes(String id) {
    int i = id.indexOf("://") + 3;
    int pathStart = id.indexOf('/', i);
    if (pathStart < 0) return id;
    return id.substring(0, pathStart) + id.substring(pathStart).replaceAll("/+", "/");
}

try { validator.validateSpiffeId(id); } catch (SpiffeConnectionException e) { log.warnf("Empty path segment in SPIFFE ID: %s", id); }

When it happens

Trigger: validateSpiffeId invoked with IDs like 'spiffe://example.org//sa/app' or 'spiffe://example.org/ns//app' — produced by double slashes from path concatenation.

Common situations: Joining path pieces where one piece already ends with '/' and the next begins with '/'; environment variables or config values with stray slashes; URL-normalization code that inserts extra separators.

Related errors

• SPIFFE ID must have a non-root path:
• SPIFFE ID path must not have a trailing slash:
• SPIFFE ID path must not contain dot segments:
• SPIFFE ID must not contain a port: ${spiffeId}
• SPIFFE ID must not contain a query:

AI-assisted analysis of quarkusio/quarkus@e1c734241f (2026-09-05). Data as JSON: /api/errors/5adf2a97a4f73475. Report an issue: GitHub.