Skip to main content

OIDC_AUDIENCE

Constant OIDC_AUDIENCE 

Source
pub const OIDC_AUDIENCE: Config<Option<&'static str>>;
Expand description

OIDC audience (client ID). When empty, audience validation is skipped. Validates that the JWT’s aud claim contains this value. When empty, audience validation is skipped. It is insecure to skip validation because it is the only mechanism preventing attackers from authenticating using a JWT issued by a dummy application, but from the same identity provider.