x-google-audiences list ignored

[gombasp]

Hi,

ESPv2 seems to be ignoring the list in x-google-audiences. In ESPv1 we used to have lists of allowed audiences and for me it seems its not working any more with v2.
For example if you have a service: https://aservice.mydevelopment.cloud.goog

...and you define your endpoint to use:

"google_id_token" : {
"type" : "oauth2",
"authorizationUrl" : "",
"flow" : "implicit",
"x-google-issuer" : "https://accounts.google.com",
"x-google-jwks_uri" : "https://www.googleapis.com/oauth2/v3/certs",
"x-google-audiences" : "https://aservice.mydevelopment.cloud.goog,https://bservice.mydevelopment.cloud.goog,https://cservice.mydevelopment.cloud.goog"
}

...then it would work only if you use https://aservice.mydevelopment.cloud.goog aud in the jwt.

Please advise - thanks.

[gombasp]

Additional info: tested wit 2.44.0

[gombasp]

Additional info: running on GKE

[gombasp]

False alarm, was incorrectly tested.