[Bug] Python JWT includes "aud": null when audience is not provided
- Dominant language
- Python
- Stars
- 200
- Forks
- 191
- Avg merge
- 6h 16m
- Merged PRs (30d)
- 17
Description
## Summary
When `audience` is not provided, the Python JWT builder includes `"aud": null` in the token payload. This can cause JWT validation failures on the server side.
## Affected Code
```python
# python/cdp/auth/utils/jwt.py
claims = {
"sub": options.api_key_id,
"iss": "cdp",
"aud": options.audience, # None → serialized as "aud": null
...
}
```
`json.dumps({"aud": None})` → `{"aud": null}` — the field is present but null.
## Fix
Only include `aud` when it's set:
```python
claims = {
"sub": options.api_key_id,
"iss": "cdp",
...
}
if options.audience:
claims["aud"] = options.audience
```
The TypeScript SDK (using `jose`) correctly omits `aud` when undefined.
## References
- TypeScript equivalent: `typescript/packages/cdp-sdk/src/auth/utils/jwt.ts`
Contributor guide
Research direction
Start in python/cdp/auth/utils/jwt.py at the claims construction, then compare the equivalent logic in typescript/packages/cdp-sdk/src/auth/utils/jwt.ts. Verify the Python JWT payload when no audience is provided and update the behavior so the aud claim is omitted rather than serialized as null.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python, typescript
- Domain
- authentication
- Issue type
- Bug
- Difficulty
- 2/5
- Estimated time
- 1-3 hours
- Activity status
- Active
- Clarity
- Clearly specified
- Newbie friendliness
- 86/100