Method verifyAudience

validator.go:237–270

verifyAudience compares the aud claim against cmp. If aud is not set or an empty list, it will succeed if the claim is not required, otherwise ErrTokenRequiredClaimMissing will be returned. Additionally, if any error occurs while retrieving the claim, e.g., when its the wrong type, an ErrTokenUnve

(claims Claims, cmp []string, expectAllAud bool)

// Additionally, if any error occurs while retrieving the claim, e.g., when its
// the wrong type, an ErrTokenUnverifiable error will be returned.
func (v *Validator) verifyAudience(claims Claims, cmp []string, expectAllAud bool) error {
	aud, err := claims.GetAudience()
	if err != nil {
		return err
	}

	// Check that aud exists and is not empty. We only require the aud claim
	// if we expect at least one audience to be present.
	if len(aud) == 0 || len(aud) == 1 && aud[0] == "" {
		required := len(v.expectedAud) > 0
		return errorIfRequired(required, "aud")
	}

	if !expectAllAud {
		for _, a := range aud {
			// If we only expect one match, we can stop early if we find a match
			if slices.Contains(cmp, a) {
				return nil
			}
		}

		return ErrTokenInvalidAudience
	}

	// Note that we are looping cmp here to ensure that all expected audiences
	// are present in the aud claim.
	for _, a := range cmp {
		if !slices.Contains(aud, a) {
			return ErrTokenInvalidAudience
		}
	}

	return nil
}

// verifyIssuer compares the iss claim in claims against cmp.
//