update audience validation logic

auth0 · Nov 29, 2023 · 4a539e6 · 4a539e6
1 parent 8fd8ca0
commit 4a539e6
Showing 1 changed file with 1 addition and 7 deletions.
diff --git a/lib/src/main/java/com/auth0/jwt/JWTVerifier.java b/lib/src/main/java/com/auth0/jwt/JWTVerifier.java
@@ -368,17 +368,11 @@ private boolean assertValidAudienceClaim(
                 List<String> expectedAudience,
                 boolean shouldContainAll
         ) {
-            if (actualAudience == null && expectedAudience == null) {
-                return true;
-            } else if (actualAudience == null || expectedAudience == null) {
+            if (actualAudience == null || expectedAudience == null) {
                 return false;
             }
 
             if (shouldContainAll) {
-                // containsAll([]) always returns true
-                if (expectedAudience.isEmpty() && !actualAudience.isEmpty()) {
-                    return false;
-                }
                 return actualAudience.containsAll(expectedAudience);
             } else {
                 return !Collections.disjoint(actualAudience, expectedAudience);