mirror of
https://github.com/hanzoai/bootnode.git
synced 2026-10-25 02:31:30 +00:00
zeekay
8d72ed288d
Adversarial review follow-up: without an aud check, a token minted for ANY client of the same IAM issuer would be accepted. NewJWKS now takes the expected audience (the deployment's IAM_CLIENT_ID); when set, tokens whose aud does not match are rejected (token minted for a different client is no longer accepted). Empty audience preserves issuer+signature-only behavior. Test: matching aud passes, mismatched aud rejected.