CustomClaims with multiple audiences cannot be unmarshalled

[auth0]

CustomClaims with multiple audiences cannot be unmarshalled

[arawden]

I was unable to reproduce this issue this morning, so feel free to close this.

[grounded042]

Hey @arawden. This sounds similar to #72. Any chance that issue gives any insight into the one you are having?

[arawden]

Hey @grounded042, it definitely looks to be equivalent.

To expand a little bit, I have an integration test which creates a token and then tries to make a request to an endpoint wrapped with the AuthedEndpoint middleware I posted. I've checked the token that gets passed to the endpoint in the jwt.io decoder, and it looks fine to me. It is the same token, roughly, as the one passed from my frontend, except it is missing the userinfo audience (I assume because the token is generated programatically), so there's only the string and no array.

With that said, I get similar behavior. If i catch the error on the token, err := jwt.ParseWithClaims(tokenString, &CustomClaims{}, func(token *jwt.Token) (interface{}, error), I get the error specified in the original bug report. As a result, when the ParseWithClaims call returns, the token struct's Valid field is set to false.

In total, both my integration tests and requests from my frontend to the endpoint wrapped with the middleware fail. In the first case, the token is considered not valid (if ok && token.Valid { fails, however the audience is fine because it is not an array), and in the second case, the CheckJWT call in the AuthedEndpoint middleware fails because the audience cannot be verified

I see there is a solution which involves converting the types in the call to VerifyAudience, however, I believe this solution would not work for me because I would need to implement a similar solution to the ParseWithClaims function.

I also see that @aaronprice00 posted a modified version of the go-jwt-middleware, however, given that my project is not dependent on authorization to move forward, I'm happy to wait for a more permanent solution.

Please let me know if you need any further information for this ticket, and I'll keep an eye on the issue you linked and try to contribute there if I can.

[grounded042]

Thanks @arawden. I just dropped a comment over in #72 if you could take a look when you get a chance: #72 (comment)

[sergiught]

We just released the v2.0.0-beta 🥳 !

You can start testing it by running go get github.com/auth0/go-jwt-middleware/[email protected].

In case of issues fetching the v2 you might want to try go clean --modcache first before doing go get.

I'm closing this issue as now this is part of v2, but feel free to reopen if needed.