JWT_AUDIENCE_MISMATCH security auth_error ai_generated true

JWT validation failed: audience 'api://wrong-service' does not match expected audience 'api://my-service'

ID: security/oauth2-jwt-audience-mismatch

Also available as: JSON · Markdown · 中文
90%Fix Rate
84%Confidence
1Evidence
2024-03-20First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
Spring Security 6.3.0 active — — —
MSAL.js 2.0.0 active — — —
PyJWT 2.9.0 active — — —
Auth0 SPA SDK 2.0.0 active — — —

Root Cause

The JWT's 'aud' (audience) claim does not match the audience configured for the resource server, often because the token was issued for a different API or the client requested the wrong audience.

generic

中文

JWT的'aud'（受众）声明与资源服务器配置的受众不匹配，通常是因为令牌是为不同的API签发的，或者客户端请求了错误的受众。

Official Documentation

https://www.rfc-editor.org/rfc/rfc7519#section-4.1.3

Workarounds

  1. 90% success Update the resource server configuration to expect the correct audience. For example, in Spring Boot, set `spring.security.oauth2.resourceserver.jwt.audiences=api://my-service`. 
    Update the resource server configuration to expect the correct audience. For example, in Spring Boot, set `spring.security.oauth2.resourceserver.jwt.audiences=api://my-service`.
  2. 85% success Ensure the client application requests the correct audience when obtaining the token. For example, in an Angular app using MSAL, set `extraQueryParameters: {audience: 'api://my-service'}`. 
    Ensure the client application requests the correct audience when obtaining the token. For example, in an Angular app using MSAL, set `extraQueryParameters: {audience: 'api://my-service'}`.
  3. 80% success If using Azure AD, verify the API's Application ID URI and ensure the client's API permissions are correctly configured to request that audience. 
    If using Azure AD, verify the API's Application ID URI and ensure the client's API permissions are correctly configured to request that audience.

中文步骤

  1. 更新资源服务器配置以期望正确的受众。例如，在Spring Boot中，设置`spring.security.oauth2.resourceserver.jwt.audiences=api://my-service`。
  2. 确保客户端应用程序在获取令牌时请求正确的受众。例如，在使用MSAL的Angular应用中，设置`extraQueryParameters: {audience: 'api://my-service'}`。
  3. 如果使用Azure AD，请验证API的应用程序ID URI，并确保客户端的API权限配置正确以请求该受众。

Dead Ends

Common approaches that don't work:

  1. 90% fail

    Changing the expected audience in the resource server to accept any audience is insecure, as it would allow tokens meant for other services to access the API.

  2. 100% fail

    Modifying the token's 'aud' claim client-side will fail signature validation, as the token is signed and any alteration invalidates the signature.

  3. 30% fail

    Clearing the browser cache and retrying does not fix the issue because the token is generated by the identity provider and the audience mismatch is a configuration problem.