Jakub Zych 18b2e85106 feat(09-01): reject cross-audience tokens on both guards ...

- Frontend verification accepts a missing audience for PHP tokens
- An explicit audience must match the guard, even when the secret is shared

2026-09-24 17:20:57 +02:00

9.3 KiB

Raw Blame History

View Raw