如何配置CouchDB仅接受带有特定aud（受众）声明的JWT？

Let me spell this out plainly—if you're working with JWTs from Google, ignoring the aud (audience) claim is a critical security misstep, and here's exactly why:

• The aud field in the JWT contains your unique application ID. It’s Google’s way of confirming, "This token was issued specifically for your app, no one else."
• If you skip validating this claim, you’re essentially leaving your site’s authentication door wide open. Any site owner with a valid Google JWT (even one issued for their own unrelated app) could use it to log into your site. That’s a straight-up unauthorized access vulnerability!

Think of it like checking the delivery address on a package before accepting it. If you just take any package that shows up, you might end up with something that’s not meant for you—and in the context of authentication, that means letting someone into your system who has no business being there.

Don’t cut corners here. Every time you process a Google JWT, make sure to verify that the aud value matches your app’s ID. Most reputable JWT libraries have built-in functions to handle this validation, so use those instead of rolling your own (you’ll avoid accidental mistakes that way).

内容的提问来源于stack exchange，提问作者todehi6124