Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

aud cliam is missing in token introspection response #22100

Open
NilukaSripalim opened this issue Dec 20, 2024 · 0 comments
Open

aud cliam is missing in token introspection response #22100

NilukaSripalim opened this issue Dec 20, 2024 · 0 comments

Comments

@NilukaSripalim
Copy link
Contributor

Description

When validating access tokens obtained via a refresh token, the token introspection response the aud (audience) claim is missing , for opaque tokens.

Additionally, during authorization code grants, the aud claim is intermittently missing in the token introspection response for opaque tokens.

For same token, sometimes 'aud ` is there , sometimes it is missing in response
Screenshot 2024-12-20 at 14 53 41

Screenshot 2024-12-20 at 14 53 49

Note: OAuth 2.0 Token Introspection specification, the aud (audience) claim is optional in the introspection response. However, Missing aud in an opaque token introspection response can cause confusion about the token's audience, leading to potential misuse.

Reproduceble in Asgardeo Dev , Prod also

Steps to Reproduce

Obtain an access token using a refresh token.
Try token introspection using the opaque token.
Observe that the aud parameter is intermittently missing from the introspection response.

Version

7.1

Environment Details (with versions)

Deice : MacBook
MacOS

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
Status: No status
Development

No branches or pull requests

1 participant