Propagate InvalidAudienceError -> invalid_token_callback, and more audience tests

Author: acrossen

flask_jwt_extended/jwt_manager.py

@@ -1,6 +1,6 @@
 import datetime
 
-from jwt import ExpiredSignatureError, InvalidTokenError
+from jwt import ExpiredSignatureError, InvalidTokenError, InvalidAudienceError
 
 from flask_jwt_extended.config import config
 from flask_jwt_extended.exceptions import (
@@ -108,6 +108,10 @@ def handle_jwt_decode_error(e):
         def handle_wrong_token_error(e):
             return self._invalid_token_callback(str(e))
 
+        @app.errorhandler(InvalidAudienceError)
+        def handle_invalid_audience_error(e):
+            return self._invalid_token_callback(str(e))
+
         @app.errorhandler(RevokedTokenError)
         def handle_revoked_token_error(e):
             return self._revoked_token_callback()

tests/test_view_decorators.py

@@ -210,6 +210,30 @@ def test_jwt_missing_claims(app):
     assert response.get_json() == {'msg': 'Missing claim: identity'}
 
 
+def test_jwt_invalid_audience(app):
+    url = '/protected'
+    jwtM = get_jwt_manager(app)
+    test_client = app.test_client()
+
+    # No audience claim expected or provided - OK
+    access_token = encode_token(app, {'identity': 'me'})
+    response = test_client.get(url, headers=make_headers(access_token))
+    assert response.status_code == 200
+
+    # Audience claim expected and not provided - not OK
+    app.config['JWT_DECODE_AUDIENCE'] = 'my_audience'
+    access_token = encode_token(app, {'identity': 'me'})
+    response = test_client.get(url, headers=make_headers(access_token))
+    assert response.status_code == 422
+    assert response.get_json() == {'msg': 'Token is missing the "aud" claim'}
+
+    # Audience claim still expected and wrong one provided - not OK
+    access_token = encode_token(app, {'aud': 'different_audience', 'identity': 'me'})
+    response = test_client.get(url, headers=make_headers(access_token))
+    assert response.status_code == 422
+    assert response.get_json() == {'msg': 'Invalid audience'}
+
+
 def test_expired_token(app):
     url = '/protected'
     jwtM = get_jwt_manager(app)