0

When a JWT id_token with a single audience is presented to a resource server which has multiple configured audience values, should the resource server reject the validity of the token on the basis of the mismatch in audiences (ie JWT has one, resource server wants all of the ones we have configured), or should the resource server accept the validity of the token on the basis of a single match (ie JWT has one, resource server has that one in its list of 4, it passes validation as a result)?

1 Answer 1

0

It is usually the other way round. A JWT token can have several audiences, but the consumer of the token only identifies as a single audience. In this case, the consumer accepts and validates a token only if his own audience is in the audience claims of the token.

Your scenario only arises if we are talking about an aggregator, like an API gateway. If an API gateway bundles several APIs with different audience claims, it has two options:

  • It passes the token on without checking the audience, trusting that the consuming API will do the validation.
  • It verifies that the audience claim is present in the token for the API that it is sent to.

In this scenario the API Gateway is just an intermediary and not the final consumer. The real consumer should always only identify as a single audience.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .