Token validation does not use require audience parameter

[DaveBrue]

System.IdentityModel.Tokens.Jwt v6.8.0

var credentials = new SigningCredentials(new JsonWebKey("<insert RSA keypair>"), "RS256");

var handler = new JwtSecurityTokenHandler();
var jwt = handler.CreateEncodedJwt(new SecurityTokenDescriptor { SigningCredentials = credentials });
var token = handler.ReadJwtToken(jwt);
Assert.Empty(token.Audiences);

var parameters = new TokenValidationParameters { RequireAudience = false, IssuerSigningKey = credentials.Key };
handler.ValidateToken(jwt, parameters, out var _);
// SecurityTokenInvalidAudienceException
// IDX10208: Unable to validate audience. validationParameters.ValidAudience is null or whitespace and validationParameters.ValidAudiences is null.

The token doesn't have an audience and it throws an audience exception but the RequireAudience parameter is false so it shouldn't throw.

[brentschmaltz]

@DaveBrue you pointed out an issue with our documentation and our code.
Indeed we do not seem to do much with require audience parameter.

We added some wiki notes here

Note: When this item is fixed, update the wiki above.

[keegan-caruso]

RequireAudience is used only for SAML and SAML2 right? The documentation on the property tries to state this

Gets or sets a value indicating whether SAML tokens must have at least one AudienceRestriction.

Should we expand the comment to explicitly state that it is not relevant for jwts?

[KrisVandermotten]

Should we expand the comment to explicitly state that it is not relevant for jwts?

Definitely not. Bugs should not be documented, bugs should be fixed.

It should be possible to validate a JWT token with logic along the lines of: "the audience is not required, but if you do send one, it should be correct".

[brentschmaltz]

@KrisVandermotten @DaveBrue assigned to @sruke
@sruke we need to have an additional check in ValidateAudience

azure-activedirectory-identitymodel-extensions-for-dotnet/src/Microsoft.IdentityModel.Tokens/Validators.cs

Line 87 in 161f199

public static void ValidateAudience(IEnumerable<string> audiences, SecurityToken securityToken, TokenValidationParameters validationParameters)

Where if the Audience is null, we will not fault if RequireAudience is false.
If the Audience is NOT null, then we will validate it regardless of the flag.

[vgribok]

AWS Cognito service-to-service (client credentials only) token does not have Audience. That's for example.

A workaround:

options.TokenValidationParameters = new TokenValidationParameters
                {
                    AudienceValidator = (_,_,_) => true
                };

[phillip-haydon]

4 Years and no fix...

[jennyf19]

4 Years and no fix...

good point @phillip-haydon - we will take a look, apologies for the delay.