napi-rs / napi-rs/node-rs

[jsonwebtoken] cannot skip audience validation

Open
#866 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Rust
Stars
1.5k
Forks
52
Avg merge
13h 37m
Merged PRs (30d)
19

Description

How to skip audience and issuer checks?

  const decoded = decodeHeader( jwtString);
  const res = await verify(
    jwtString,
    cert,
    { algorithms: [ decoded.algorithm ], aud: undefined, iss: undefined, sub: undefined }
  );
// Throws { "code": "GenericFailure", "stack": "InvalidAudience" }

not defining or giving an empty array is not working too.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by reproducing the supplied JavaScript example through verify, comparing the behavior of omitted, undefined, and empty audience or issuer options. Trace the verify entry point to find where InvalidAudience is produced; done means the intended skip behavior is established and covered by a regression test.

Written by the indexing model from the issue text.

Assessment

Tech stack
nodejs, rust
Domain
authentication, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.