Skip to content

NullPointerException when checking empty audience #674

@viapivov

Description

@viapivov

Checklist

  • I have looked into the Readme and Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Description

We've encountered a bug in 4.4.0 when checking if the token is issued for audience that in some cases may be empty. It used to work with 3.19.4.

Here's a snippet to reproduce it.

    @Test
    public void testEmptyAudJwtClaim() {
        String[] allowedAudience = new String[0];
        String token = JWT.create().withAudience("wide audience").sign(Algorithm.HMAC256("secret"));

        JWTVerifier verifier = JWT.require(Algorithm.HMAC256("secret")).withAudience(allowedAudience).build();
        
        verifier.verify(token);
    }

The workaround we've found is to exclude withAudience check in case if audience is empty.

Reproduction

  1. Claim token
  2. Include check with empty audience
  3. Verify the token to include all the audience

Additional context

No response

java-jwt version

4.4.0

Java version

11

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugThis points to a verified bug in the code

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions