explicitly set audience in samples

[Erwinvandervalk]

There is a vulnerability in the samples:

The Vulnerability (CVE-2025-27370/CVE-2025-27371):

 - A malicious authorization server can trick a client into creating a JWT with an attacker-controlled aud (audience) claim
 - When the aud is set to the token endpoint URL (e.g., https://attacker.com/connect/token), the attacker can reuse that JWT to impersonate the client at a different

authorization server that has the same token endpoint path
- This is called "audience injection" and allows authentication bypass

By explicitly setting the audience to the authorization server's issuer identifier (the authority) rather than the full token endpoint URL, we prevent the vulnerability because:

 - The JWT is now bound to the specific authorization server's issuer
 - Even if an attacker controls a malicious AS, they cannot reuse the JWT at another AS since the audience would be different
 - This aligns with the OIDF remediation guidance that states: "Clients should only insert the correct AS issuer identifier as the aud claim"

[Copilot]

Pull request overview

This PR addresses a security vulnerability (CVE-2025-27370/CVE-2025-27371) in JWT client assertion samples by changing the audience claim from the token endpoint URL to the authorization server's issuer identifier. This prevents audience injection attacks where a malicious authorization server could reuse JWTs at different authorization servers.

Key changes:

• Replaced dynamic TokenEndpoint audience values with hardcoded issuer identifier "https://demo.duendesoftware.com"
• Added explanatory comments in WebJarJwt sample referencing the OIDF security advisory

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 6 comments.

File	Description
access-token-management/samples/WorkerDI/ClientAssertionService.cs	Updated audience from token endpoint to issuer identifier
access-token-management/samples/Worker/ClientAssertionService.cs	Updated audience from token endpoint to issuer identifier
access-token-management/samples/WebJarJwt/ClientAssertionService.cs	Updated audience from token endpoint to issuer identifier with explanatory comments

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.