Support for Oauth Audiences
- Dominant language
- JavaScript
- Stars
- 19.4k
- Forks
- 3.1k
- Avg merge
- 1d 14h
- Merged PRs (30d)
- 9
Description
**Is your feature request related to a problem? Please describe.**
For security purposes, Oauth servers require an audience to be provided so that a JWT token can be issued.
If the audience is not provided the server won't issue a standard JWT token.
**Describe the solution you'd like**
Allow developers to specify the audience in the configuration file and forward the audience while redirecting to the user to oauth provider server.
**Describe alternatives you've considered**
There are no alternatives. I've validated that this works by intercepting the redirect and injecting the audience parameter.
**Additional context**
Without the audience its not possible to integrated with services like Auth0.
https://auth0.com/docs/get-started/authentication-and-authorization-flow/authorization-code-flow/call-your-api-using-the-authorization-code-flow#authorize-user
Example from the Auth0 documentation:
```
Sign In
```
Contributor guide
Research direction
Start by locating the OAuth configuration and the code that constructs the redirect to the provider. Trace how configured authorization parameters are forwarded, then verify that a configured audience appears in the redirect and supports the Auth0 authorization-code example described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- javascript
- Domain
- authentication
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100