Server accepts bearer tokens with no audience claim

What it means

AUDIENCE-001 catches servers that accept a token issued for a different resource. This check catches a related mistake: a server whose audience check is written so that a missing aud claim slips through. The common shape is `if (aud && aud !== me) reject`. A token with no aud makes the first condition false and the reject never runs. Per RFC 9068 Section 4, a resource server must reject any JWT whose aud does not contain its own identifier. "Does not contain" includes "is not there at all." A token with no aud is as invalid as a token with the wrong aud. The check is opt-in because it needs a validly signed bearer token for the server's authorization server whose payload has no aud claim. Without that token the check stays silent.

How to fix

Rewrite audience validation so a missing claim is a reject. For a single-string aud: `if (aud !== me) reject`. For an array aud: `if (!Array.isArray(aud) || !aud.includes(me)) reject`. Never fall back to accepting a token whose aud is absent.

Spec