Custom `ValidateWithLeeway` in #176 Introduced Breaking Changes to Token Validation

[auth0]

Custom `ValidateWithLeeway` in #176 Introduced Breaking Changes to Token Validation

[sergiught]

Hey @josh-feldman 👋🏻

Thanks for raising this and apologies for the unexpected behavior change. The fact that the previous version allowed passing an empty audience slice and skipping the validation, was flawed and was considered a bug. Validation should always occur on the issuer, audience and time based claims.

[josh-feldman]

@sergiught should we at least change the error to validate an empty audience array as invalid expectations or at least one audience must be specified? The current error for not passing in an audience array and getting back that the token is invalid regardless of whether the audience field exists or not is misleading.

[sergiught]

Agreed @josh-feldman, the error message definitely needs to be improved and fire earlier when we set up the validator in case the audience is nil or len 0. I'll try to find some time to improve that soon. Thanks!