v0.14 is out: a mobile auth pack for Swift/iOS and Android, catching insecure token storage, cleartext traffic, and OAuth in embedded WebViews. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.rust.jwt.no-aud-validation

JWT audience (aud) validation is disabled by setting validate_aud: false on the jsonwebtoken Validation.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

With the audience check turned off, a token minted for a different service is accepted by decode, so an attacker can replay a token issued for another audience against this API.

Keep validate_aud at its default true and declare the audience you expect via validation.set_audience(&["my-api"]), so only tokens whose aud claim matches your service are accepted.

VULNERABLE
vulnerable.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    aud: String,
    exp: usize,
}

fn decode_assignment(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS256);
    // ruleid: auth.rust.jwt.no-aud-validation
    validation.validate_aud = false;
    decode::<Claims>(token, key, &validation).unwrap().claims
}

fn decode_assignment_default(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::default();
    // ruleid: auth.rust.jwt.no-aud-validation
    validation.validate_aud = false;
    decode::<Claims>(token, key, &validation).unwrap().claims
}
SAFE
safe.rs
use jsonwebtoken::{decode, Algorithm, DecodingKey, Validation};
use serde::Deserialize;

#[derive(Debug, Deserialize)]
struct Claims {
    sub: String,
    aud: String,
    exp: usize,
}

// ok: auth.rust.jwt.no-aud-validation -- audience explicitly validated
fn decode_with_audience(token: &str, key: &DecodingKey) -> Claims {
    let mut validation = Validation::new(Algorithm::HS256);
    validation.set_audience(&["my-api"]);
    decode::<Claims>(token, key, &validation).unwrap().claims
}

// ok: auth.rust.jwt.no-aud-validation -- default validation keeps validate_aud = true
fn decode_default(token: &str, key: &DecodingKey) -> Claims {
    let validation = Validation::new(Algorithm::HS256);
    decode::<Claims>(token, key, &validation).unwrap().claims
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.rust.jwt.no-aud-validation -- <reason>

References

https://docs.rs/jsonwebtoken/latest/jsonwebtoken/struct.Validation.html#structfield.validate_aud ↗https://cwe.mitre.org/data/definitions/287.html ↗