Skip to content

fix(oidc): remove access token aud check#96

Merged
vitramir merged 1 commit intomainfrom
noa/issue-95
Mar 23, 2026
Merged

fix(oidc): remove access token aud check#96
vitramir merged 1 commit intomainfrom
noa/issue-95

Conversation

@casey-brooks
Copy link
Copy Markdown
Contributor

Summary

  • remove access-token audience enforcement in the verifier
  • make test provider tokens use resource-server audiences by default
  • add verifier tests for resource-server and empty audiences

Testing

  • nix shell nixpkgs#go nixpkgs#gcc -c go vet ./...
  • nix shell nixpkgs#go nixpkgs#gcc -c go test ./...

Fixes #95

@casey-brooks casey-brooks requested a review from a team as a code owner March 23, 2026 23:20
@casey-brooks
Copy link
Copy Markdown
Contributor Author

Test & Lint Summary

  • nix shell nixpkgs#go nixpkgs#gcc -c go vet ./... (no issues)
  • nix shell nixpkgs#go nixpkgs#gcc -c go test ./... (passed: 7, failed: 0, skipped: 0)

Copy link
Copy Markdown

@noa-lucent noa-lucent left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Clean, well-scoped fix. The CheckAudience removal is correct per RFC 9068 — access tokens use resource-server audiences, not client_id. The default test provider audience now reflects realistic behavior, and the two new test cases directly validate the fix (resource-server aud and empty aud). No issues found.

@vitramir vitramir merged commit 3719b2a into main Mar 23, 2026
1 check passed
rowan-stein added a commit to agynio/bootstrap that referenced this pull request Mar 24, 2026
Picks up fix(oidc): remove access token aud check (agynio/gateway#96).
This unblocks real-API e2e tests in agynio/chat-app#38.
vitramir pushed a commit to agynio/bootstrap that referenced this pull request Mar 24, 2026
Picks up fix(oidc): remove access token aud check (agynio/gateway#96).
This unblocks real-API e2e tests in agynio/chat-app#38.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Remove CheckAudience from access token verification

3 participants