Skip to content

Jwt audience validation: support array instead of only string #374

@ericbl

Description

@ericbl

Current implementation of jwt.decode with audience support only one string:
https://github.com/mpdavis/python-jose/blob/master/jose/jwt.py#L483

while pyjwt support a list of audiences:
https://github.com/jpadilla/pyjwt/blob/master/jwt/api_jwt.py#L499

as well as authlib:
https://github.com/lepture/authlib/blob/main/authlib/jose/rfc7519/claims.py#L130
but authlib is quite different implementation.

is python-jose a fork of pyjwt?
if yes, can this fork get updated?
if not, can we update specific methods? Especially this one?

is is anyway still recommended to use python-jose? I see quite some comments recommending authlib instead...
edit: looking at the release history, 3.3.0 from 2020-06 but 3.4.0 from 2025-02, so almost after 5 years. I understand people leaving the boat.
Is there a new will to maintain this lib?
choosing between the 3 is not easy...

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions