diff --git a/.gitignore b/.gitignore index 8ed2328..d136520 100644 --- a/.gitignore +++ b/.gitignore @@ -14,6 +14,8 @@ /docs/_build/ /htmlcov/ +env/ # Editors .idea/ +.vscode/ \ No newline at end of file diff --git a/README.rst b/README.rst index 01565b3..7fb04fb 100644 --- a/README.rst +++ b/README.rst @@ -35,7 +35,7 @@ Add the following lines to your Django ``settings.py`` file: COGNITO_AWS_REGION = '' # 'eu-central-1' COGNITO_USER_POOL = '' # 'eu-central-1_xYzaq' - COGNITO_AUDIENCE = '' + COGNITO_AUDIENCE = '' # or = ['', 'client id 2', ...] (Optional) If you want to cache the Cognito public keys between requests you can enable the ``COGNITO_PUBLIC_KEYS_CACHING_ENABLED`` setting (it only works if you diff --git a/src/django_cognito_jwt/validator.py b/src/django_cognito_jwt/validator.py index c25d3f3..0d1d2a5 100644 --- a/src/django_cognito_jwt/validator.py +++ b/src/django_cognito_jwt/validator.py @@ -16,6 +16,7 @@ class TokenValidator: def __init__(self, aws_region, aws_user_pool, audience): self.aws_region = aws_region self.aws_user_pool = aws_user_pool + #should be either a single audience string, or an array of audience strings self.audience = audience @cached_property diff --git a/tests/test_validator.py b/tests/test_validator.py index 4322c08..f3ea7a6 100644 --- a/tests/test_validator.py +++ b/tests/test_validator.py @@ -17,6 +17,19 @@ def test_validate_token(cognito_well_known_keys, jwk_private_key_one): auth.validate(token) +def test_validate_token_multiple_aud(cognito_well_known_keys, jwk_private_key_one): + token = create_jwt_token( + jwk_private_key_one, + { + "iss": "https://cognito-idp.eu-central-1.amazonaws.com/bla", + "aud": "my-audience-2", + "sub": "username", + }, + ) + auth = validator.TokenValidator("eu-central-1", "bla", ["my-audience", "my-audience-2", "my-audience-3"]) + auth.validate(token) + + def test_validate_token_error_key(cognito_well_known_keys, jwk_private_key_two): token = create_jwt_token( jwk_private_key_two, @@ -46,6 +59,21 @@ def test_validate_token_error_aud(cognito_well_known_keys, jwk_private_key_one): auth.validate(token) +def test_validate_token_multiple_aud_error_aud(cognito_well_known_keys, jwk_private_key_one): + token = create_jwt_token( + jwk_private_key_one, + { + "iss": "https://cognito-idp.eu-central-1.amazonaws.com/bla", + "aud": "other-audience", + "sub": "username", + }, + ) + auth = validator.TokenValidator("eu-central-1", "bla", ["my-audience", "my-audience-2", "my-audience-3"]) + + with pytest.raises(validator.TokenError): + auth.validate(token) + + @pytest.mark.parametrize( "is_cache_enabled,responses_calls", [(None, 2), (False, 2), (True, 1)] )