-
Notifications
You must be signed in to change notification settings - Fork 71
Open
Labels
Description
Checklist
- I have looked into the Readme and the Examples, and have not found a suitable solution or answer.
- I have looked into the API documentation and have not found a suitable solution or answer.
- I have searched the issues and have not found a suitable solution or answer.
- I have searched the Auth0 Community forums and have not found a suitable solution or answer.
- I agree to the terms within the Auth0 Code of Conduct.
Describe the problem you'd like to have solved
The verify function in class Omniauth::Auth0::JWTValidator only validates checks that client_id is included in the audience of the given token. This works for validation of id token, but not for access token. Users may want to manually verify any tokens since this class is publicly accessible.
Describe the ideal solution
It could be useful to either have 2 functions (e.g. verifyIdToken and a more general verify) or set the client_id as validation parameters when calling verify on id tokens.
Alternatives and current workarounds
Currently one can only use the decode function of said class and verify claims on their own.
Additional context
No response
graham-jobber