Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.
Why this matters
With the audience unchecked, a token that was minted for a different API or client is accepted here, turning this service into a confused deputy and enabling cross-service token replay (CWE-287). This is a common AI-generated shortcut: validation is switched off to silence an aud mismatch during wiring and never restored.
Leave ValidateAudience at its secure default (true) and pin the expected audience with ValidAudience (or ValidAudiences) so only tokens issued for this API are honored.
VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, // ruleid: auth.csharp.jwt.validate-audience-disabled ValidateAudience = false, ValidateLifetime = true, }; }); }}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ // An OIDC framework validates the audience itself, outside any JWT bearer // registration. Disabling the built-in check here is deliberate, not a // footgun, so it must NOT fire (no AddJwtBearer context). public static readonly TokenValidationParameters FrameworkDefaults = new TokenValidationParameters { ValidateAudience = false, }; public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateAudience = true, ValidAudience = "https://api.example.com", }; }); }}
Suppressing this rule
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.