Merge pull request auth0#5 from skarkkai-p/array-valued-audience

pose · pose · commit 5171ed4e604b · 2014-09-05T09:12:06.000-03:00
Support array-valued audience
diff --git a/src/main/java/com/auth0/jwt/JWTVerifier.java b/src/main/java/com/auth0/jwt/JWTVerifier.java
@@ -1,6 +1,5 @@
 package com.auth0.jwt;
 
-import com.fasterxml.jackson.core.type.TypeReference;
 import com.fasterxml.jackson.databind.JsonNode;
 import com.fasterxml.jackson.databind.ObjectMapper;
 import org.apache.commons.codec.binary.Base64;
@@ -125,11 +124,21 @@ void verifyIssuer(JsonNode jwtClaims) {
     }
 
     void verifyAudience(JsonNode jwtClaims) {
-        final String audienceFromToken = jwtClaims.has("aud") ? jwtClaims.get("aud").asText() : null;
-
-        if (audienceFromToken != null && !audience.equals(audienceFromToken)) {
-            throw new IllegalStateException("jwt audience invalid");
+        if (audience == null)
+            return;
+        JsonNode audNode = jwtClaims.get("aud");
+        if (audNode == null)
+            return;
+        if (audNode.isArray()) {
+            for (JsonNode jsonNode : audNode) {
+                if (audience.equals(jsonNode.textValue()))
+                    return;
+            }
+        } else if (audNode.isTextual()) {
+            if (audience.equals(audNode.textValue()))
+                return;
         }
+        throw new IllegalStateException("jwt audience invalid");
     }
 
     String getAlgorithm(JsonNode jwtHeader) {
diff --git a/src/test/java/com/auth0/jwt/JWTVerifierTest.java b/src/test/java/com/auth0/jwt/JWTVerifierTest.java
@@ -1,14 +1,15 @@
 package com.auth0.jwt;
 
 import com.fasterxml.jackson.databind.JsonNode;
+import com.fasterxml.jackson.databind.ObjectMapper;
+import com.fasterxml.jackson.databind.node.ArrayNode;
 import com.fasterxml.jackson.databind.node.JsonNodeFactory;
 import com.fasterxml.jackson.databind.node.ObjectNode;
+
 import org.apache.commons.codec.binary.Base64;
 import org.junit.Test;
 
 import java.security.SignatureException;
-import java.util.Collections;
-import java.util.Map;
 
 import static org.junit.Assert.assertEquals;
 
@@ -137,6 +138,26 @@ public void shouldVerifyAudienceWhenNotFoundInClaimsSet() throws Exception {
                 .verifyAudience(JsonNodeFactory.instance.objectNode());
     }
 
+    @Test
+    public void shouldVerifyNullAudience() throws Exception {
+        new JWTVerifier("such secret")
+                .verifyAudience(createSingletonJSONNode("aud", "wow"));
+    }
+
+    @Test
+    public void shouldVerifyArrayAudience() throws Exception {
+        new JWTVerifier("such secret", "amaze audience")
+                .verifyAudience(createSingletonJSONNode("aud",
+                        new ObjectMapper().readValue("[ \"foo\", \"amaze audience\" ]", ArrayNode.class)));
+    }
+    
+    @Test(expected = IllegalStateException.class)
+    public void shouldFailArrayAudience() throws Exception {
+        new JWTVerifier("such secret", "amaze audience")
+                .verifyAudience(createSingletonJSONNode("aud",
+                        new ObjectMapper().readValue("[ \"foo\" ]", ArrayNode.class)));
+    }
+    
     @Test
     public void decodeAndParse() throws Exception {
         final Base64 encoder = new Base64(true);
@@ -156,4 +177,10 @@ public static JsonNode createSingletonJSONNode(String key, String value) {
         jsonNodes.put(key, value);
         return jsonNodes;
     }
+
+    public static JsonNode createSingletonJSONNode(String key, JsonNode value) {
+        final ObjectNode jsonNodes = JsonNodeFactory.instance.objectNode();
+        jsonNodes.put(key, value);
+        return jsonNodes;
+    }
 }
