diff --git a/backend/app/cmd/server.go b/backend/app/cmd/server.go index 42c9b3f3..07dd2c3b 100644 --- a/backend/app/cmd/server.go +++ b/backend/app/cmd/server.go @@ -1215,6 +1215,7 @@ func (s *ServerCommand) getAuthenticator(ds *service.DataStore, avas avatar.Stor if c.User == nil { return c } + // Audience is a slice but we set it to a single element, and situation when there is no audience or there are more than one is unexpected if len(c.Audience) != 1 { return c } diff --git a/backend/app/rest/api/admin.go b/backend/app/rest/api/admin.go index 34ab9933..9b6809a5 100644 --- a/backend/app/rest/api/admin.go +++ b/backend/app/rest/api/admin.go @@ -107,8 +107,9 @@ func (a *admin) deleteMeRequestCtrl(w http.ResponseWriter, r *http.Request) { return } + // Audience is a slice but we set it to a single element, and situation when there is no audience or there are more than one is unexpected if len(claims.Audience) != 1 { - rest.SendErrorJSON(w, r, http.StatusBadRequest, fmt.Errorf("bad request"), "can't process token, aud is not a single element", rest.ErrActionRejected) + rest.SendErrorJSON(w, r, http.StatusBadRequest, fmt.Errorf("bad request"), "can't process token, claims.Audience expected to be a single element but it's not", rest.ErrActionRejected) return } diff --git a/backend/app/rest/api/admin_test.go b/backend/app/rest/api/admin_test.go index b13dc7b0..6afac8cc 100644 --- a/backend/app/rest/api/admin_test.go +++ b/backend/app/rest/api/admin_test.go @@ -847,7 +847,7 @@ func TestAdmin_DeleteMeRequestFailed(t *testing.T) { b, err = io.ReadAll(resp.Body) assert.NoError(t, err) assert.NoError(t, resp.Body.Close()) - assert.Contains(t, string(b), "can't process token, aud is not a single element") + assert.Contains(t, string(b), "can't process token, claims.Audience expected to be a single element but it's not") badClaimsMultipleAudience.RegisteredClaims.Audience = jwt.ClaimStrings{"remark42"} }