-
Notifications
You must be signed in to change notification settings - Fork 99
Open
Description
Feature Request: Add Audience (aud) Claim Support
Problem
The current @cloudflare/workers-oauth-provider package doesn't support the aud (audience) claim, which is recommended in OAuth 2.0 best practices (RFC 9068) for identifying the intended recipient of tokens.
Proposed Solution
- Add optional
audienceparameter tocompleteAuthorization()method - Store audience in token grant data
- Include
audclaim in introspection responses (Create an introspection endpoint #72) - Maintain backward compatibility
Use Cases
- Multi-service architectures where tokens should be restricted to specific resource servers
- Enhanced security for applications following OAuth 2.0 best practices
- Compliance with enterprise security requirements
Implementation Details
- Add
audience?: string | string[]to authorization options - Store in grant data alongside
clientIdandscope - Include in introspection response as
audfield - Optional feature - no breaking changes
Metadata
Metadata
Assignees
Labels
No labels