Package JWT: allow clients to optionally enforce matching of aud, iss and sub claims

[techmanmike]

Purpose: Allow clients to enforce matching aud, iss and sub claims

Changes:

• created DecoderParserOptions with MustMatchAudience, MustMatchIssuer and MustMatchSubject methods
• updated jwt/README.md

[AndrewMcCraeCA]

jwt.io seems to parse our example token as an array of strings

Do we need to cater for mutliple audiences? or would we only ever expect 1 aud value?

[techmanmike]

Yes - the encoded claims can specify multiple audiences, but the decoder just checks that the aud that is "itself" is in that list.

See decoder.go line 123:

if parserOptions.expectedAud != "" {
opts = append(opts, jwt.WithAudience(parserOptions.expectedAud))
}

That "jwt.WithAudience()" goes onto be implemented inside go-jwt as:

func (v *Validator) verifyAudience(claims Claims, cmp string, required bool) error {
aud, err := claims.GetAudience()
if err != nil {
return err
}

if len(aud) == 0 {
	return errorIfRequired(required, "aud")
}

// use a var here to keep constant time compare when looping over a number of claims
result := false

var stringClaims string
for _, a := range aud {
	if subtle.ConstantTimeCompare([]byte(a), []byte(cmp)) != 0 {
		result = true
	}
	stringClaims = stringClaims + a
}

// case where "" is sent in one or many aud claims
if stringClaims == "" {
	return errorIfRequired(required, "aud")
}

return errorIfFalse(result, ErrTokenInvalidAudience)

}

Which loops through all the audiences and check that "this" audience is in that list.

Make sense?

[AndrewMcCraeCA]

Left one comment but otherwise looks good

[github-actions]

Package	Line Rate	Health
github.com/cultureamp/ca-go/cipher	79%	➖
github.com/cultureamp/ca-go/env	95%	✔
github.com/cultureamp/ca-go/jwt	87%	✔
github.com/cultureamp/ca-go/kafka/consumer	82%	✔
github.com/cultureamp/ca-go/launchdarkly	71%	➖
github.com/cultureamp/ca-go/launchdarkly/evaluationcontext	96%	✔
github.com/cultureamp/ca-go/log	93%	✔
github.com/cultureamp/ca-go/ref	100%	✔
github.com/cultureamp/ca-go/request	100%	✔
github.com/cultureamp/ca-go/secrets	41%	❌
github.com/cultureamp/ca-go/sentry	99%	✔
Summary	88% (1876 / 2128)	✔