JWT 中的 aud 字段是什么意思

[daijinming]

JWT 中的 aud 字段是什么意思 网上给出的解释都是 [接收 jwt 的一方] ，那具体怎么理解那？

[wei745359223]

应该就是申请这个 token 的 client 信息 比如 IP 啥的？

[reus]

audience
用户 id 应该放这里的。

[jimzhong]

audience, 接受 JWT 的一方。接受方须检查该字段以避免一些攻击。

https://tools.ietf.org/html/rfc7519#section-4.1.3

[xomix]

// Audience(s) that this ID Token is intended for. It MUST contain the OAuth 2.0
// client_id of the Relying Party as an audience value. It MAY also contain identifiers
// for other audiences. In the general case, the aud value is an array of case sensitive
// strings. In the common special case when there is one audience, the aud value
// MAY be a single case sensitive string.

客户端信息

[Vegetable]

The "aud" (audience) claim identifies the recipients that the JWT is
intended for. Each principal intended to process the JWT MUST
identify itself with a value in the audience claim. If the principal
processing the claim does not identify itself with a value in the
"aud" claim when this claim is present, then the JWT MUST be
rejected. In the general case, the "aud" value is an array of case-
sensitive strings, each containing a StringOrURI value. In the
special case when the JWT has one audience, the "aud" value MAY be a
single case-sensitive string containing a StringOrURI value. The
interpretation of audience values is generally application specific.
Use of this claim is OPTIONAL.