Skip to content

Proposal: Add JWT audience in security scheme #3286

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Conversation

emmanuelgautier
Copy link

As described in the JWT RFC and in the OpenId Connect spec for example, audience must be verified.

A client can request the audience during an OAuth 2.0 authorization flow, so having audience in the OpenAPI can be convenient. This audience documentation can also be used to add more documentation about the API security strategy and ensure the security is enforced.

@Saud96525 Saud96525 linked an issue May 30, 2023 that may be closed by this pull request
@emmanuelgautier emmanuelgautier force-pushed the add-jwt-audience-security branch from 1acd02e to 134cf47 Compare June 5, 2023 22:07
@handrews handrews added this to the v3.2.0 milestone Jan 30, 2024
@handrews handrews added the security: auth Authentication including overlap with authorization label Feb 1, 2024
@darrelmiller
Copy link
Member

This would be a good suggestion to trial as an x- to see the demand for this and the value it can bring. It would also be good to bring this proposal along with other JWT related issues.

@handrews
Copy link
Member

@emmanuelgautier since @darrelmiller suggested trying this out as an x- field first, I'm going to close this for now. There is an issue already tracking this topic:

which mentions an x-audience, so if that's already being done and there's evidence that it's being used and working, please feel free to re-submit this PR and point to where it's being used. We will also keep the issue open for consideration in 3.2 or some later 3.x with other JWT issues, as we have several that have been filed. But it does not seem like there's enough consensus to add this to the spec yet.

@emmanuelgautier
Copy link
Author

Thanks @darrelmiller and @handrews both for your review and sorry if I missed a submission process. This is my first contribution to the spec.

As suggested, more comments will be added then in the following issue about tokens here: #2239.

@handrews
Copy link
Member

@emmanuelgautier no worries about missing the process- we're coming out of a bit of a hibernation period and we're working on documenting our current processes through our Contributor Guidance Project. So you didn't miss anything that you should have been able to figure out right now- we're working on it!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
security: auth Authentication including overlap with authorization security
Projects
None yet
Development

Successfully merging this pull request may close these issues.

tbarn:coc-enforcement-doc
4 participants