diff --git a/jwt/validation.go b/jwt/validation.go index 09d8541..8df3c61 100644 --- a/jwt/validation.go +++ b/jwt/validation.go @@ -89,11 +89,16 @@ func (c Claims) ValidateWithLeeway(e Expected, leeway time.Duration) error { } if len(e.Audience) != 0 { + flag := false for _, v := range e.Audience { - if !c.Audience.Contains(v) { - return ErrInvalidAudience + if c.Audience.Contains(v) { + flag = true + break } } + if !flag { + return ErrInvalidAudience + } } // validate using the e.Time, or time.Now if not provided diff --git a/jwt/validation_test.go b/jwt/validation_test.go index 7d6e843..10d964e 100644 --- a/jwt/validation_test.go +++ b/jwt/validation_test.go @@ -44,6 +44,17 @@ func TestFieldsMatch(t *testing.T) { assert.NoError(t, c.Validate(v)) } + claimsWithSingleAudience := Claims{ + Issuer: "issuer", + Subject: "subject", + Audience: []string{"a1"}, + ID: "42", + } + + for _, v := range valid { + assert.NoError(t, claimsWithSingleAudience.Validate(v)) + } + invalid := []struct { Expected Expected Error error