golang-jwt / jwt / 16000167377

70%

Build Type

push

github

Committed by web-flow

Commit Message

Fix bug in validation of multiple audiences (#441)

* Fix bug in validation of multiple audiences

In a situation where multiple audiences are validated by the
validator, the order of evaluation of the for-range loop
affects the result.

If we produce matches such as:

```
{
  "example.org": true,
  "example.com": false,
}
```

and we configured the validator to expect a single match on
audience, the code would either:

1. produce "token has invalid audience" if "example.org" was
evaluated first

2. produce a passing result if "example.com" was evaluated first

This commit fixes this bug, and adds a suite of tests as well
as regression tests to prevent this issue in future.

* Adding three more test cases to be sure

* Removing required alltogether form verifyAudience

* Removing required

---------

Co-authored-by: Christian Banse <oxisto@aybaze.com>

Run Details

15 of 15 new or added lines in 1 file covered. (100.0%)

18 existing lines in 1 file now uncovered.

977 of 1394 relevant lines covered (70.09%)

15.23 hits per line