otto-de / otto-de/api-guidelines
[update] remove rule MUST NOT validate audience of the JSON Web Token
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 50
- Forks
- 16
- PR merge metrics
- No merged PRs in 30d
Description
(i) This issue has been manually transferred from a former internal repository, as a private repository issue cannot be transferred to a public repository.
Context
The rule describes how the "aud" claim is used within api.otto.de. The usage and validation of the "aud" claim can make sense for other OAuth2 processes.
Instead of having a rule, we should improve api.otto.de's documentation of the OAuth2 server, as this rule is tightly bound to how api.otto.de's OAuth2 server works.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by locating the rule about validating the JWT "aud" claim and the documentation for api.otto.de's OAuth2 server. Confirm that the rule is tightly coupled to that server, then remove or update it and document the server-specific audience behavior; done means the general guideline no longer presents this as a universal rule.
Written by the indexing model from the issue text.
Assessment
- Domain
- api, authentication, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100