这是indexloc提供的服务,不要输入任何密码
Skip to content

Improve JWTValidator to also validate access tokens #180

@Artenuvielle

Description

@Artenuvielle

Checklist

  • I have looked into the Readme and the Examples, and have not found a suitable solution or answer.
  • I have looked into the API documentation and have not found a suitable solution or answer.
  • I have searched the issues and have not found a suitable solution or answer.
  • I have searched the Auth0 Community forums and have not found a suitable solution or answer.
  • I agree to the terms within the Auth0 Code of Conduct.

Describe the problem you'd like to have solved

The verify function in class Omniauth::Auth0::JWTValidator only validates checks that client_id is included in the audience of the given token. This works for validation of id token, but not for access token. Users may want to manually verify any tokens since this class is publicly accessible.

Describe the ideal solution

It could be useful to either have 2 functions (e.g. verifyIdToken and a more general verify) or set the client_id as validation parameters when calling verify on id tokens.

Alternatives and current workarounds

Currently one can only use the decode function of said class and verify claims on their own.

Additional context

No response

Metadata

Metadata

Assignees

No one assigned

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions