Comment by jsiepkes

5 hours ago

Not checking the "audience" of a token or misconfiguring it is pretty common. A lot of applications don't actually check it.

0 comments