Fix bug if application does not specify audience

AUTHORS

@@ -25,3 +25,5 @@ Patches and Suggestions
  - Michael Davis <[email protected]> <[email protected]>
 
  - Vinod Gupta <[email protected]>
+
+ - Derek Weitzel <[email protected]>

CHANGELOG.md

@@ -10,6 +10,8 @@ This project adheres to [Semantic Versioning](http://semver.org/).
 
 ### Fixed
 
+- Audience parameter throws `InvalidAudienceError` when application does not specify an audience, but the token does. [#336][336]
+
 ### Added
 
 [v1.6.0][1.6.0]

jwt/api_jwt.py

@@ -168,6 +168,11 @@ def _validate_aud(self, payload, audience):
             # verified since the token does not contain a claim.
             raise MissingRequiredClaimError('aud')
 
+        if audience is None and 'aud' in payload:
+            # Application did not specify an audience, but
+            # the token has the 'aud' claim
+            raise InvalidAudienceError('Audience is specified in the payload, but not the application')
+
         audience_claims = payload['aud']
 
         if isinstance(audience_claims, string_types):

tests/test_api_jwt.py

@@ -288,6 +288,15 @@ def test_check_audience_list_when_valid(self, jwt):
         token = jwt.encode(payload, 'secret')
         jwt.decode(token, 'secret', audience=['urn:you', 'urn:me'])
 
+    def test_check_audience_none_specified(self, jwt):
+        payload = {
+            'some': 'payload',
+            'aud': 'urn:me'
+        }
+        token = jwt.encode(payload, 'secret')
+        with pytest.raises(InvalidAudienceError):
+            jwt.decode(token, 'secret')
+
     def test_raise_exception_invalid_audience_list(self, jwt):
         payload = {
             'some': 'payload',