Require non-empty ID token audience

dinvlad · Aug 22, 2020 · c4462ab · c4462ab
1 parent ffe213d
commit c4462ab
Showing 1 changed file with 2 additions and 0 deletions.
diff --git a/google_yubikey/device.py b/google_yubikey/device.py
@@ -131,6 +131,8 @@ def get_id_token(yubikey: YubiKey, slot: int, prompt_management_key: bool,
                  service_account_email: str, audience: str,
                  token_lifetime: int, stream=sys.stderr):
     """ Generates a Google ID token with a YubiKey """
+    if not audience:
+        raise ValueError('ID tokens must use a non-empty audience')
     return _get_jwt(
         yubikey, slot, prompt_management_key,
         service_account_email, audience, [], token_lifetime, stream,