auth0 / go-jwt-middleware

A Middleware for Go Programming Language to check for JWTs on HTTP requests
MIT License
1.08k stars 205 forks source link

Fail to instantiate validator when audience is an empty string #183

Closed sergiught closed 1 year ago

sergiught commented 1 year ago

📝 Checklist

🔧 Changes

An empty audience should never be allowed to be set when the validator gets instantiated.

What happens currently is that if an audience is set as empty on the validator, the validation of the JWT will still fail but only within the request lifecycle.

We're adding the extra len(audience) validation now on the validator so we can fail earlier on app bootstrap in case we pass a nil or empty audience.

📚 References

🔬 Testing