This repository was archived by the owner on Jul 2, 2025. It is now read-only.
Sandbox assumes client_assertion audience (aud) is single value #45
Description
According to the JWT RFC (https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3), the aud (audience) header is either an array or a string. Certain JWT libraries (e.g. https://github.com/lestrrat-go/jwx) always serialize the audience as an array, making it hard or impossible to use certain (client) libraries with the SMART on FHIR sandbox.
When aud is an array, the following error occurs:
token.aud.replace is not a function