Skip to content

Commit

Permalink
Clarify aud OIDC claim check
Browse files Browse the repository at this point in the history
  • Loading branch information
liamdiprose committed Dec 11, 2024
1 parent 9c0d8e8 commit 5e0be2a
Show file tree
Hide file tree
Showing 2 changed files with 12 additions and 2 deletions.
11 changes: 10 additions & 1 deletion spec/unit/oidc/validate.spec.ts
Original file line number Diff line number Diff line change
Expand Up @@ -170,14 +170,23 @@ describe("validateIdToken()", () => {
expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
});

it("should not throw for a list of trusted audiences", () => {
it("should not throw when audience is an array that includes clientId", () => {
mocked(jwtDecode).mockReturnValue({
...validDecodedIdToken,
aud: [clientId],
});
expect(() => validateIdToken(idToken, issuer, clientId, nonce)).not.toThrow();
});

it("should throw when audience is an array that does not include clientId", () => {
mocked(jwtDecode).mockReturnValue({
...validDecodedIdToken,
aud: [`${clientId},uiop`, "asdf"],
});
expect(() => validateIdToken(idToken, issuer, clientId, nonce)).toThrow(new Error(OidcError.InvalidIdToken));
expect(logger.error).toHaveBeenCalledWith("Invalid ID token", new Error("Invalid audience"));
});

it("should throw when nonce does not match", () => {
mocked(jwtDecode).mockReturnValue({
...validDecodedIdToken,
Expand Down
3 changes: 2 additions & 1 deletion src/oidc/validate.ts
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,8 @@ export const validateIdToken = (
* The ID Token MUST be rejected if the ID Token does not list the Client as a valid audience, or if it contains additional audiences not trusted by the Client.
* EW: Don't accept tokens with other untrusted audiences
* */
if (claims.aud !== clientId && !(Array.isArray(claims.aud) && claims.aud.includes(clientId))) {
const sanitisedAuds = typeof claims.aud === 'string' ? [claims.aud] : claims.aud;
if (!sanitisedAuds.includes(clientId)) {
throw new Error("Invalid audience");
}

Expand Down

0 comments on commit 5e0be2a

Please sign in to comment.