x-google-audiences list ignored

Hi,

ESPv2 seems to be ignoring the list in x-google-audiences. In ESPv1 we used to have lists of allowed audiences and for me it seems its not working any more with v2.
For example if you have a service: https://aservice.mydevelopment.cloud.goog

...and you define your endpoint to use:

"google_id_token" : {
"type" : "oauth2",
"authorizationUrl" : "",
"flow" : "implicit",
"x-google-issuer" : "https://accounts.google.com",
"x-google-jwks_uri" : "https://www.googleapis.com/oauth2/v3/certs",
"x-google-audiences" : "https://aservice.mydevelopment.cloud.goog,https://bservice.mydevelopment.cloud.goog,https://cservice.mydevelopment.cloud.goog"
}

...then it would work only if you use https://aservice.mydevelopment.cloud.goog aud in the jwt.

Please advise - thanks.

No source file or test is named. Start by reproducing the ESPv2 configuration with the comma-separated x-google-audiences value and a JWT for each listed audience, then trace the audience validation entry point. Done means every configured audience is accepted consistently, with regression coverage for the list behavior.

Written by the indexing model from the issue text.