Verifying multiple audiences about jwt HOT 2 OPEN

Just to double-check: Are you sure you want to check against multiple expected audiences?

What WithAudience does, it checks all supplied audience, whether one of them includes the expected one (or is equal to it, in the case of just one audience). Usually your application should define one expected audience (e.g., its own hostname or an application name or a similar semantic) and then check for that particular one. I am not so sure about what the semantics about multiple expected audiences would entail.

If there is a valid use case for it, I suppose we (or rather you ;) as part of a PR) could add the WithAudiences parser option. Although there is probably a discussion then whether all expected audiences must match or any of them.

We tried to do the most basic functionality first in v5 and then see where we could add additional features that make sense.

from jwt.

@oxisto Would you still be open to accepting a PR for this feature?

Although there is probably a discussion then whether all expected audiences must match or any of them.

Perhaps the option could be configurable in this sense, e.g.

func WithAudiences(auds []string, matchAll bool) ParserOption {}

from jwt.