Fixes for issuer and audience only being checked when they have values

index.js

@@ -52,17 +52,15 @@ module.exports.verify = function(jwtString, secretOrPublicKey, options, callback
       return callback(new Error('jwt expired'));
   }
 
-  if (payload.aud && options.audience) {
+  if (options.audience) {
     if (payload.aud !== options.audience)
       return callback(new Error('jwt audience invalid. expected: ' + payload.aud));
   }
 
-  if (payload.iss && options.issuer) {
+  if (options.issuer) {
     if (payload.iss !== options.issuer)
       return callback(new Error('jwt issuer invalid. expected: ' + payload.iss));
   }
 
   callback(null, payload);
 };
-
-

test/jwt.rs.tests.js

@@ -12,7 +12,7 @@ describe('RS256', function() {
 
   describe('when signing a token', function() {
     var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
-  
+
     it('should be syntactically valid', function() {
       expect(token).to.be.a('string');
       expect(token.split('.')).to.have.length(3);
@@ -40,7 +40,7 @@ describe('RS256', function() {
 
   describe('when signing a token with expiration', function() {
     var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', expiresInMinutes: 10 });
-  
+
     it('should be valid expiration', function(done) {
       jwt.verify(token, pub, function(err, decoded) {
         assert.isNotNull(decoded);
@@ -64,9 +64,9 @@ describe('RS256', function() {
 
   describe('when signing a token with audience', function() {
     var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', audience: 'urn:foo' });
-  
+
     it('should check audience', function(done) {
-      jwt.verify(token, pub, function(err, decoded) {
+      jwt.verify(token, pub, { audience: 'urn:foo' }, function(err, decoded) {
         assert.isNotNull(decoded);
         assert.isNull(err);
         done();
@@ -83,9 +83,22 @@ describe('RS256', function() {
 
   });
 
+  describe('when signing a token without audience', function() {
+    var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
+
+    it('should check audience', function(done) {
+      jwt.verify(token, pub, { audience: 'urn:wrong' }, function(err, decoded) {
+        assert.isUndefined(decoded);
+        assert.isNotNull(err);
+        done();
+      });
+    });
+
+  });
+
   describe('when signing a token with issuer', function() {
     var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256', issuer: 'urn:foo' });
-  
+
     it('should check issuer', function() {
       jwt.verify(token, pub, { issuer: 'urn:foo' }, function(err, decoded) {
         assert.isNotNull(decoded);
@@ -101,6 +114,17 @@ describe('RS256', function() {
     });
   });
 
+  describe('when signing a token without issuer', function() {
+    var token = jwt.sign({ foo: 'bar' }, priv, { algorithm: 'RS256' });
+
+    it('should check issuer', function() {
+      jwt.verify(token, pub, { issuer: 'urn:foo' }, function(err, decoded) {
+        assert.isUndefined(decoded);
+        assert.isNotNull(err);
+      });
+    });
+  });
+
   describe('when verifying a malformed token', function() {
     it('should throw', function(done) {
       jwt.verify('fruit.fruit.fruit', pub, function(err, decoded) {
@@ -112,4 +136,4 @@ describe('RS256', function() {
   });
 
 
-});
+});