2026-09-06 · 8 min read
- jwt
- oauth
- security
The aud claim identifies recipients for which a JWT is intended. Under the JWT data model it can be a single string or an array of strings, while a particular OAuth or application profile may impose narrower rules.
A valid signature proves integrity under a selected key; it does not prove that the current API was an intended recipient. Audience validation must occur before claims influence authorization.
Define accepted recipients as a profile
Document the exact issuer and audience identifiers accepted by each endpoint or service. Use stable identifiers assigned by the authorization system rather than deriving expectations from an untrusted Host header or whichever internal route handled the request.
- Accept string and array forms only according to the chosen profile.
- Require an exact match against a constrained server-side set.
- Do not apply substring, suffix, wildcard, or case-folded matching.
- Reject missing, empty, or wrongly typed claims when aud is required.
Keep claim responsibilities separate
Audience identifies a recipient; issuer identifies the authority; scope or roles describe allowed operations; subject identifies a principal. One successful check cannot substitute for the others.
Validate the algorithm, signature, issuer, audience, expiration, not-before time, and profile-specific claims through a maintained library. Apply authorization after validation using explicit endpoint policy.
Align gateways without trusting rewrites
If both a gateway and application validate tokens, record each component's accepted issuers, audiences, algorithms, key refresh behavior, clock tolerance, and failure response. Their profiles should be compatible without making the inner service trust arbitrary forwarded claim headers.
- Authenticate any trusted proxy-to-service identity separately.
- Forward the original token only over a protected internal path when required.
- Avoid changing aud to make a token pass another service.
- Log validation categories and request IDs, never bearer tokens.
Create typed audience fixtures
Use Flashman's JWT tool for synthetic claims, JSON formatter to expose string and array types, diff to compare validator configuration, URL tool to inspect URI-shaped identifiers, and timestamp converter for time boundaries. Browser decoding does not verify trust.
Test one and multiple audiences, exact and near matches, wrong case, missing and malformed claims, wrong issuer, expired tokens, key rotation, gateway forwarding, direct service access, and each supported library version.