feat(backend): Propagate audience option to verifyToken

[appden]

Type of change

• 🐛 Bug fix
• 🌟 New feature
• 🔨 Breaking change
• 📖 Refactoring / dependency upgrade / documentation
• other:

Packages affected

• @clerk/clerk-js
• @clerk/clerk-react
• @clerk/nextjs
• @clerk/remix
• @clerk/types
• @clerk/themes
• @clerk/localizations
• @clerk/clerk-expo
• @clerk/backend
• @clerk/clerk-sdk-node
• @clerk/shared
• @clerk/fastify
• gatsby-plugin-clerk
• build/tooling/chore

Description

• npm test runs as expected.
• npm run build runs as expected.

In rare circumstances, one may want to specify the audience to validate the token against since the aud claim may be specified in the session customization settings. Also, if the audience is not specified for verification, then the presence of the aud claim should not result in a failure.

[jit-ci]

Hi, I’m Jit, a friendly security platform designed to help developers build secure applications from day zero with an MVS (Minimal viable security) mindset.

In case there are security findings, they will be communicated to you as a comment inside the PR.

Hope you’ll enjoy using Jit.

Questions? Comments? Want to learn more? Get in touch with us.

[jit-ci]

✅ Great news! Jit hasn't found any security issues in your PR. Good Job! 🏆

[nikosdouvlis]

Thanks for the contribution @appden :)
We'll take a look as soon as possible.

[dimkl]

@appden Could you provide some information about your use case ?
Currently the JWT verification depends on authorizedParties and azp claim instead of aud.
Why do you need to pass a specific aud claim in the session customization settings and validate against it in the your server ?

[appden]

Why do you need to pass a specific aud claim in the session customization settings and validate against it in the your server ?

My primary reason at the moment is I'm integrating with MongoDB Atlas, which requires an aud claim, and I'd much prefer to use the existing token instead of creating a JWT template and having to request a separate token when interacting with Atlas.

[dimkl]

@appden i will close this PR and open a new one that will allow the audience: string | string[] to be passed as option to"@clerk/backend" from all the other clerk packages.
I will try to push this by the end of day.

[dimkl]

Closing this in favour of : #1004