cloudflare / cloudflare/pages-plugins
Should Access plugin allow JWT's without aud, iss, exp, nbf?
Open
validated
- Dominant language
- TypeScript
- Stars
- 62
- Forks
- 21
- PR merge metrics
- No merged PRs in 30d
Description
I was copying some of the Access plugin jwt validator code and noticed it allows JWT payloads without aud, iss, exp, and nbf fields. Is this intended? Will Access JWTs ever be missing these fields? It seems odd to allow tokens without them.
https://github.com/cloudflare/pages-plugins/blob/main/packages/cloudflare-access/functions/_middleware.ts?at=90281ad52b77506bb7723a8db813e19723725509#L85-L102
Contributor guide
Assessment
This issue has not been assessed yet.