Giters

golang-jwt / jwt

Go implementation of JSON Web Tokens (JWT).

Home Page:https://golang-jwt.github.io/jwt/

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

"aud" claim type

Virviil opened this issue · comments

commented

https://pkg.go.dev/github.com/golang-jwt/jwt#StandardClaims "aud" type is string.
The problem is that https://www.rfc-editor.org/rfc/rfc7519.html#section-4.1.3 specifies that

In the general case, the "aud" value is an array of case-sensitive strings, each containing a StringOrURI value.

This attitude can't be emulated with standard claims, because type is specified as string.
One can encode json array into string, but it's unnecessary complication.
Another option - to use custom claims.

Any suggestions?

Appending example of JWT with array-typed audience:
https://jwt.io/#debugger-io?token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJzdWIiOiIxMjM0NTY3ODkwIiwibmFtZSI6IkpvaG4gRG9lIiwiaWF0IjoxNTE2MjM5MDIyLCJhdWQiOlsiaG9zdDEuY29tIiwiaG9zdDIuY29tIl19.o8PWKkFWMx_iYWC9JtdAgusgYPuQ61rtnPszkD857jg

commented

For historic reasons, we kept around the StandardClaims and didn't modify them to avoid breaking existing users.

Instead, we added RegisteredClaims which likely does what you want. Can you give this a try?

https://pkg.go.dev/github.com/golang-jwt/jwt/v5#RegisteredClaims

commented

Going to close this issue. But if you need a bit more help let us know and/or reopen the issue.