GraphQL: cannot unmarshal array into Go struct field StandardClaims.aud of type string

[dpeek]

JWT aud is an array, GraphQL endpoint is expecting a string it seems:

{
  "https://www.example.com/jwt/claims": {
    "USER": "github|XXXXX",
    "ROLE": "ADMIN"
  },
  "iss": "https://example.us.auth0.com/",
  "sub": "github| XXXXX",
  "aud": [
    "https://www.example.com",
    "https://example.us.auth0.com/userinfo"
  ],
  "iat": 1593154207,
  "exp": 1593240607,
  "azp": "X",
  "scope": "openid profile email",
  "permissions": []
}

[dpeek]

I think this might be relevant:
https://community.auth0.com/t/my-token-has-multiple-audiences-is-that-normal/41417/2

GraphQL / Slash docs use ID token, which shouldn't be used for APIs apparently? And ID tokens only have one aud while access tokens include 2 (your api and the auth0 tennant url)

[dpeek]

Look like this is supported in jtw-go v4, so should be as simple as bumping the version for that.
dgrijalva/jwt-go#188

[pawanrawal]

@dpeek I am curious to know how did you run into this issue. Did you try and use Auth0 with Slash GraphQL with some special config or just with the default config?

[dpeek]

Hi @pawanrawal, I followed the instructions for using Auth0 with a PWA, and it seems the "aud" claim for an access token there always contains two items: your Auth0 tennant URL and your API "identifier". The Slash tutorial suggests using the ID token, which is supposedly not what ID tokens are for (auth0/auth0-spa-js#54).

Weirdly, when I tried the approach suggested in the tutorial, my ID token had no custom claims in it.

[minhaj-shakeel]

Github issues have been deprecated.
This issue has been moved to discuss. You can follow the conversation there and also subscribe to updates by changing your notification preferences.