Add support for aud array and scalar strings Fixes #33

index.js

@@ -71,7 +71,11 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback
 
   if (options.audience) {
     var audiences = Array.isArray(options.audience)? options.audience : [options.audience];
-    if (audiences.indexOf(payload.aud) < 0)
+    var target = Array.isArray(payload.aud) ? payload.aud : [payload.aud];
+    
+    var match = target.some(function(aud) { return audiences.indexOf(aud) != -1; });
+
+    if (!match)
       return callback(new JsonWebTokenError('jwt audience invalid. expected: ' + payload.aud));
   }
 

test/jwt.hs.tests.js

@@ -49,12 +49,14 @@ describe('HS256', function() {
       });
     });
 
-    it.only('should throw when the payload is not json', function(done) {
+    it('should throw when the payload is not json', function(done) {
       var token = jwt.sign('bar', 'secret', { algorithm: 'HS256' });
-      jwt.verify(token, 'secret', function() {
+      jwt.verify(token, 'secret', function(err, decoded) {
+        assert.isUndefined(decoded);
+        assert.isNotNull(err);
         done();
       });
     });
 
   });
-});
+});

test/jwt.rs.tests.js

@@ -104,6 +104,55 @@ describe('RS256', function() {
 
   });
 
+  describe('when signing a token with array audience', function() {
+    var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', audience: [ 'urn:foo', 'urn:bar' ] });
+
+    it('should check audience', function(done) {
+      jwt.verify(token, pub, { audience: 'urn:foo' }, function(err, decoded) {
+        assert.isNotNull(decoded);
+        assert.isNull(err);
+        done();
+      });
+    });
+
+    it('should check other audience', function(done) {
+      jwt.verify(token, pub, { audience: 'urn:bar' }, function(err, decoded) {
+        assert.isNotNull(decoded);
+        assert.isNull(err);
+        done();
+      });
+    });
+
+    it('should check audience in array', function(done) {
+      jwt.verify(token, pub, { audience: ['urn:foo', 'urn:other'] }, function (err, decoded) {
+        assert.isNotNull(decoded);
+        assert.isNull(err);
+        done();
+      });
+    });
+
+    it('should throw when invalid audience', function(done) {
+      jwt.verify(token, pub, { audience: 'urn:wrong' }, function(err, decoded) {
+        assert.isUndefined(decoded);
+        assert.isNotNull(err);
+        assert.equal(err.name, 'JsonWebTokenError');
+        assert.instanceOf(err, jwt.JsonWebTokenError);
+        done();
+      });
+    });
+
+    it('should throw when invalid audience in array', function(done) {
+      jwt.verify(token, pub, { audience: ['urn:wrong', 'urn:morewrong'] }, function(err, decoded) {
+        assert.isUndefined(decoded);
+        assert.isNotNull(err);
+        assert.equal(err.name, 'JsonWebTokenError');
+        assert.instanceOf(err, jwt.JsonWebTokenError);
+        done();
+      });
+    });
+
+  });
+
   describe('when signing a token without audience', function() {
     var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });