coheigea commented on code in PR #3518:
URL: https://github.com/apache/cxf/pull/3518#discussion_r4132726199
##########
rt/rs/security/oauth-parent/oauth2/src/main/java/org/apache/cxf/rs/security/oauth2/grants/jwt/AbstractJwtHandler.java:
##########
@@ -69,6 +69,11 @@ protected void validateClaims(Client client, JwtClaims
claims) {
if (claims.getClaim(JwtConstants.CLAIM_EXPIRY) == null) {
throw new OAuthServiceException(OAuthConstants.INVALID_GRANT);
}
+
+ // We must have an Audience (RFC 7523, section 3)
+ if (claims.getAudiences().isEmpty()) {
Review Comment:
Good catch, thanks! Moved the check into JwtUtils: validateTokenClaims /
validateJwtAudienceRestriction now take an audienceRequired flag, which the JWT
bearer handlers set to true (RFC 7523 ยง3) and the JWT filter maps to its
requireAudience option. The existing signatures delegate with false, so other
callers such as JwtAccessTokenValidator keep their current behavior.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
