-
Notifications
You must be signed in to change notification settings - Fork 942
Closed
Labels
bugThis points to a verified bug in the codeThis points to a verified bug in the code
Description
Checklist
- I have looked into the Readme and Examples, and have not found a suitable solution or answer.
- I have looked into the API documentation and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Description
We've encountered a bug in 4.4.0 when checking if the token is issued for audience that in some cases may be empty. It used to work with 3.19.4.
Here's a snippet to reproduce it.
@Test
public void testEmptyAudJwtClaim() {
String[] allowedAudience = new String[0];
String token = JWT.create().withAudience("wide audience").sign(Algorithm.HMAC256("secret"));
JWTVerifier verifier = JWT.require(Algorithm.HMAC256("secret")).withAudience(allowedAudience).build();
verifier.verify(token);
}The workaround we've found is to exclude withAudience check in case if audience is empty.
Reproduction
- Claim token
- Include check with empty audience
- Verify the token to include all the audience
Additional context
No response
java-jwt version
4.4.0
Java version
11
Metadata
Metadata
Assignees
Labels
bugThis points to a verified bug in the codeThis points to a verified bug in the code