[jsonwebtoken] cannot skip audience validation
Open
Nobody has claimed this yet.
- Dominant language
- Rust
- Stars
- 1.5k
- Forks
- 52
- Avg merge
- 13h 37m
- Merged PRs (30d)
- 19
Description
How to skip audience and issuer checks?
const decoded = decodeHeader( jwtString);
const res = await verify(
jwtString,
cert,
{ algorithms: [ decoded.algorithm ], aud: undefined, iss: undefined, sub: undefined }
);
// Throws { "code": "GenericFailure", "stack": "InvalidAudience" }
not defining or giving an empty array is not working too.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the supplied JavaScript example through verify, comparing the behavior of omitted, undefined, and empty audience or issuer options. Trace the verify entry point to find where InvalidAudience is produced; done means the intended skip behavior is established and covered by a regression test.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- nodejs, rust
- Domain
- authentication, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100