doorkeeper 6.0.0.beta2 → 6.0.0.rc2

data/lib/doorkeeper/http_fetcher.rb

@@ -13,13 +13,15 @@ module Doorkeeper
   # SSRF hardening: the host is resolved up front and the request is refused
   # when any resolved address falls into an RFC 6890 special-use range
   # (loopback, private-use, link-local, ...). The connection is then pinned
-  # to the vetted address via Net::HTTP#ipaddr= so a second, post-check DNS
+  # to a vetted address via Net::HTTP#ipaddr= so a second, post-check DNS
   # resolution (DNS rebinding) cannot redirect the request; TLS is still
-  # negotiated and verified against the original hostname. An exception for
-  # authorization servers themselves running on a loopback interface is
-  # intentionally not implemented. These rules follow the fetch hardening of
-  # draft-ietf-oauth-client-id-metadata-document (Sections 6.5 / 6.6), which
-  # fetches documents from the same kind of client-chosen URL.
+  # negotiated and verified against the original hostname. When that address
+  # cannot be connected to, the host's remaining vetted addresses are tried
+  # in turn. An exception for authorization servers themselves running on a
+  # loopback interface is intentionally not implemented. These rules follow
+  # the fetch hardening of draft-ietf-oauth-client-id-metadata-document
+  # (Sections 6.5 / 6.6), which fetches documents from the same kind of
+  # client-chosen URL.
   #
   # The response body is bounded and so is the total time spent reading it:
   # a per-read timeout alone does not stop a server that dribbles bytes out
@@ -87,6 +89,15 @@ module Doorkeeper
 
     FetchError = Class.new(StandardError)
 
+    # A transport failure raised while the connection was still being
+    # established. We'll try to connect to another address if we see this
+    # error.
+    #
+    # Note that this includes some errors that can happen after establishing a
+    # TCP connection such as failing to complete a TLS handshake.
+    ConnectError = Class.new(StandardError)
+    private_constant :ConnectError
+
     # Everything a host can fail at while answering, so that it surfaces as
     # a rejected client rather than an exception out of the endpoint.
     #
@@ -123,9 +134,23 @@ module Doorkeeper
       # and Resolv raises ArgumentError, not ResolvError, when handed nil.
       raise FetchError, "#{url.inspect} has no host" if uri.host.blank?
 
-      address = vetted_address_for(uri.host)
+      addresses = vetted_addresses_for(uri.host)
+      # One deadline covers connection attempts to all addresses in aggregate.
+      deadline = monotonic_now + MAX_TOTAL_TIME
+      # If we attempt to connect to multiple addresses and all of them fail,
+      # arbitrarily surface the last error we received although all of them are
+      # equally valid.
+      last_error = nil
+
+      addresses.each do |address|
+        break if last_error && monotonic_now >= deadline
 
-      perform_request(uri, address)
+        return perform_request(uri, address, deadline)
+      rescue ConnectError => e
+        last_error = e
+      end
+
+      raise FetchError, "could not connect to #{uri.host}: #{last_error.message}"
     rescue *TRANSPORT_ERRORS => e
       raise FetchError, "#{e.class}: #{e.message}"
     end
@@ -144,7 +169,7 @@ module Doorkeeper
 
     private
 
-    def vetted_address_for(host)
+    def vetted_addresses_for(host)
       addresses = @resolver.getaddresses(host)
       raise FetchError, "could not resolve #{host}" if addresses.empty?
 
@@ -155,16 +180,34 @@ module Doorkeeper
         raise FetchError, "#{host} resolves to a special-use address (RFC 6890)"
       end
 
-      addresses.first.to_s
+      addresses.map(&:to_s)
     end
 
-    def perform_request(uri, address)
-      http = Net::HTTP.new(uri.host, uri.port)
-      http.use_ssl = true
-      http.ipaddr = address
-      http.open_timeout = OPEN_TIMEOUT
-      http.read_timeout = READ_TIMEOUT
+    def connection_for(uri, address, deadline)
+      remaining = remaining_until(deadline)
+      raise ConnectError, "no time left to connect to #{address}" if remaining <= 0
+
+      Net::HTTP.new(uri.host, uri.port).tap do |http|
+        http.use_ssl = true
+        http.ipaddr = address
+        # Net::HTTP can use up to the whole `open_timeout` establishing the TCP
+        # connection and again for the TLS handshake. Rather than potentially
+        # exceeding `MAX_TOTAL_TIME` by up to `OPEN_TIMEOUT` seconds, we pass
+        # in half the timeout to keep the true open time within `OPEN_TIMEOUT`.
+        #
+        # The initial request is unaffected because half of `MAX_TOTAL_TIME` is
+        # not less than `OPEN_TIMEOUT`.
+        http.open_timeout = [OPEN_TIMEOUT, remaining / 2.0].min
+        http.read_timeout = READ_TIMEOUT
+        # Disable Net::HTTP internal retries to prevent re-attempting reads
+        # which will reuse the same timeout params and may exceed the overall
+        # timeout we're aiming for.
+        http.max_retries = 0
+      end
+    end
 
+    def perform_request(uri, address, deadline)
+      http = connection_for(uri, address, deadline)
       request = Net::HTTP::Get.new(
         uri.request_uri,
         # Without an explicit Accept-Encoding, Net::HTTP negotiates gzip and
@@ -173,21 +216,29 @@ module Doorkeeper
         # on the compressed size. A 5 kilobyte document does not need it.
         { "Accept" => "application/json", "Accept-Encoding" => "identity" },
       )
-      deadline = monotonic_now + MAX_TOTAL_TIME
       body = nil
+      connected = false
 
       http.start do |connection|
+        connected = true
+        # Re-set this timeout later in the connection to account for the time
+        # we spent trying to connect to the address.
+        connection.read_timeout = [READ_TIMEOUT, remaining_until(deadline)].min
         # Net::HTTP never follows redirects on its own; a 3xx just fails
         # the status check below.
         connection.request(request) do |response|
           raise FetchError, "expected 200 OK from #{uri.host}, got #{response.code}" unless response.is_a?(Net::HTTPOK)
 
           verify_media_type!(response, uri.host)
-          body = bounded_body(response, uri.host, deadline)
+          body = bounded_body(response, connection, uri.host, deadline)
         end
       end
 
       body
+    rescue *TRANSPORT_ERRORS => e
+      raise if connected
+
+      raise ConnectError, "#{e.class}: #{e.message}"
     end
 
     def verify_media_type!(response, host)
@@ -203,7 +254,7 @@ module Doorkeeper
     # Reads the response in chunks so an oversized (or endlessly dribbled)
     # body is abandoned instead of buffered in full. Raising here unwinds
     # out of Net::HTTP#start, which closes the connection.
-    def bounded_body(response, host, deadline)
+    def bounded_body(response, connection, host, deadline)
       declared = response["Content-Length"]
       if declared && declared.to_i > MAX_RESPONSE_SIZE
         raise FetchError, "#{host} declares a #{declared} byte document, over the " \
@@ -220,6 +271,11 @@ module Doorkeeper
         elsif monotonic_now > deadline
           raise FetchError, "reading the document from #{host} took too long"
         end
+
+        # Shorten the timeout for the next read if we've already spent a lot of
+        # time connecting and reading part of the request. Otherwise we could
+        # overshoot `MAX_TOTAL_TIME` by up to `READ_TIMEOUT` seconds.
+        connection.read_timeout = [connection.read_timeout, remaining_until(deadline)].min
       end
 
       body
@@ -228,5 +284,9 @@ module Doorkeeper
     def monotonic_now
       Process.clock_gettime(Process::CLOCK_MONOTONIC)
     end
+
+    def remaining_until(deadline)
+      [deadline - monotonic_now, 0].max
+    end
   end
 end

data/lib/doorkeeper/models/access_token_mixin.rb

@@ -179,6 +179,34 @@ module Doorkeeper
         access_token.refresh_token.present? == !!token_attributes[:use_refresh_token]
       end
 
+      # Checks whether a candidate token's refresh token carries the scope
+      # the current request grants.
+      #
+      # A refresh token issued for a grant carries that grant's scope
+      # (RFC 6749 §6). A candidate whose refresh token was granted a wider
+      # scope than the access token it is paired with (a chain narrowed by an
+      # earlier refresh) would hand the new grant a refresh token able to mint
+      # more than the grant allows, so it is not reused. Rows without a stored
+      # granted scope (no column, or created before its migration) report the
+      # access token scope and match as before, and a candidate without a
+      # refresh token has nothing to mint with, so its stored value is not
+      # consulted.
+      #
+      # @param access_token [Doorkeeper::AccessToken]
+      #   the candidate token for reuse
+      # @param scopes [Doorkeeper::OAuth::Scopes]
+      #   scopes the request grants
+      #
+      # @return [Boolean] true if the candidate's refresh token scope equals
+      #   the requested scopes, false otherwise
+      #
+      def refresh_token_scopes_match?(access_token, scopes)
+        return true unless refresh_token_scopes_supported?
+        return true if access_token.refresh_token.blank?
+
+        access_token.refresh_token_scopes == scopes
+      end
+
       # Checks whether the token scopes match the scopes from the parameters
       #
       # @param token_scopes [#to_s]
@@ -262,6 +290,20 @@ module Doorkeeper
         column_names.include?("resource")
       end
 
+      # RFC 6749 §6: a refresh token keeps the scope originally granted by the
+      # resource owner even when the access tokens issued with it are
+      # narrowed, so that a later refresh can restore the granted scope.
+      # Doorkeeper tracks that scope in the `refresh_token_scopes` column
+      # (added by the `doorkeeper:refresh_token_scopes` generator). Without
+      # the column a refresh is validated against the presented access
+      # token's scope, so a narrowed refresh permanently narrows the chain.
+      #
+      # @return [Boolean] true if the refresh_token_scopes column exists
+      #
+      def refresh_token_scopes_supported?
+        column_names.include?("refresh_token_scopes")
+      end
+
       # Looking for not expired AccessToken record with a matching set of
       # scopes that belongs to specific Application and Resource Owner.
       # If it doesn't exists - then creates it.
@@ -275,7 +317,12 @@ module Doorkeeper
       # @param token_attributes [Hash]
       #   Additional attributes to use when creating a token
       # @option token_attributes [Integer] :expires_in
-      #   token lifetime in seconds
+      #   token lifetime in seconds. It is used as given for a new token: with
+      #   +public_client_access_token_expires_in+ configured, pass a TTL
+      #   already capped for the application (see
+      #   +Doorkeeper::OAuth::Authorization::Token.access_token_expires_in+ or
+      #   +.cap_for_public_client+), since an existing token that outlives the
+      #   cap is not reused for a public client
       # @option token_attributes [Boolean] :use_refresh_token
       #   whether to use the refresh token
       #
@@ -297,13 +344,21 @@ module Doorkeeper
           #
           # RFC 8707: resource indicators must also match so that a token
           # audience-restricted to one resource is never reused for another.
+          #
+          # A token that would outlive +public_client_access_token_expires_in+
+          # is not handed out again either, so the cap holds for a public
+          # client whatever tokens it was issued before.
           requested_resource = token_attributes[:resource]
 
           access_token = matching_token_for(
             application, resource_owner, scopes, custom_attributes: custom_attributes, include_expired: false,
           ) do |token|
             refresh_token_matches?(token, token_attributes) &&
-              resource_indicators_match?(token, requested_resource)
+              refresh_token_scopes_match?(token, scopes) &&
+              resource_indicators_match?(token, requested_resource) &&
+              Doorkeeper::OAuth::Authorization::Token.within_public_client_expires_in?(
+                Doorkeeper.config, application, token,
+              )
           end
 
           return access_token if access_token&.reusable?
@@ -429,6 +484,55 @@ module Doorkeeper
       !!@use_refresh_token
     end
 
+    # Scope the refresh token was issued with: the scope originally granted
+    # by the resource owner (RFC 6749 §6), which the refresh grant validates
+    # a requested scope against and issues the next refresh token with.
+    #
+    # Falls back to the access token scope when the `refresh_token_scopes`
+    # column is absent or empty (rows that predate its migration), which is
+    # the behavior Doorkeeper had before the column existed.
+    #
+    # @return [Doorkeeper::OAuth::Scopes] refresh token scope
+    #
+    def refresh_token_scopes
+      stored = refresh_token_scopes_string
+      return scopes if stored.blank?
+
+      OAuth::Scopes.from_string(stored)
+    end
+
+    # @param value [String, Array, Doorkeeper::OAuth::Scopes, nil]
+    #   scope to store; normalized the same way `scopes=` is. A blank value
+    #   means "no explicit granted scope", so `generate_refresh_token` derives
+    #   it from the access token scope as if nothing had been assigned.
+    #   Ignored when the `refresh_token_scopes` column is absent, so a host
+    #   app that assigns it ahead of the migration keeps the fallback above
+    #   instead of failing on the missing attribute.
+    def refresh_token_scopes=(value)
+      return unless self.class.refresh_token_scopes_supported?
+
+      normalized =
+        if value.is_a?(Array)
+          OAuth::Scopes.from_array(value).to_s
+        else
+          OAuth::Scopes.from_string(value.to_s).to_s
+        end
+
+      @refresh_token_scopes_assigned = normalized.present?
+      super(normalized)
+    end
+
+    # Raw `refresh_token_scopes` column value, nil when the column is
+    # absent.
+    #
+    # @return [String, nil]
+    #
+    def refresh_token_scopes_string
+      return unless self.class.refresh_token_scopes_supported?
+
+      self[:refresh_token_scopes]
+    end
+
     # JSON representation of the Access Token instance.
     #
     # @return [Hash] hash with token data
@@ -548,6 +652,20 @@ module Doorkeeper
     # @return [String] refresh token value
     #
     def generate_refresh_token
+      # A refresh token issued outside the refresh grant (authorization code,
+      # password, or a host app creating the record itself) starts its chain
+      # with the granted scope: the access token's own scope. The refresh
+      # grant assigns the attribute explicitly to carry the presented refresh
+      # token's scope forward instead.
+      #
+      # This callback runs on every validation of a new record, so the
+      # derived value is written each time rather than only when blank:
+      # a scope narrowed between `valid?` and `save` must not leave the
+      # refresh token with the wider scope of the earlier validation. The
+      # column is written directly so the derivation does not count as an
+      # explicit assignment.
+      self[:refresh_token_scopes] = scopes.to_s if self.class.refresh_token_scopes_supported? && !@refresh_token_scopes_assigned
+
       @raw_refresh_token = UniqueToken.generate
       secret_strategy.store_secret(self, :refresh_token, @raw_refresh_token)
     end

data/lib/doorkeeper/models/concerns/secret_storable.rb

@@ -70,8 +70,9 @@ module Doorkeeper
           end
         end
 
-        # Allow implementations in ORMs to replace a plain
-        # value falling back to to avoid it remaining as plain text.
+        # Replaces a value found through the fallback strategy with its
+        # upgraded form, so it does not remain stored under the old strategy
+        # (e.g. as plain text).
         #
         # @param instance
         #   An instance of this model with a plain value token.
@@ -82,13 +83,78 @@ module Doorkeeper
         # @param plain_secret
         #   The plain secret to upgrade.
         #
+        # @return [Boolean]
+        #   Whether the stored value was upgraded.
+        #
         def upgrade_fallback_value(instance, attr, plain_secret)
+          # The value the fallback strategy matched against, read before
+          # `store_secret` assigns the upgraded one over it.
+          matched = instance.public_send(attr)
           upgraded = secret_strategy.store_secret(instance, attr, plain_secret)
 
-          # The upgrade is a write on what is otherwise a read path (finding a
-          # record by its secret), so it must reach the primary database when
-          # automatic role switching would route the surrounding request to a
-          # read replica.
+          return true if write_upgraded_secret(instance, attr, matched, upgraded)
+
+          # Nothing was written: put the instance back rather than leave it
+          # carrying a secret that was never stored.
+          restore_matched_secret(instance, attr, matched)
+          false
+        end
+
+        # ORM hook: puts +matched+ back on +instance+ after nothing was
+        # written. This default assigns through the attribute writer, which
+        # an ORM can bypass the way the Active Record implementation does:
+        # a custom writer can transform +matched+ on the way in, leaving the
+        # attribute dirty with a value the row never held, and a later save
+        # would write that over whatever replaced the matched secret — the
+        # stale write the conditional upgrade exists to prevent.
+        #
+        # @param instance
+        #   The instance to restore, still carrying the unwritten upgrade.
+        #
+        # @param attr
+        #   The secret attribute name being restored.
+        #
+        # @param matched
+        #   The stored value the fallback lookup matched.
+        #
+        def restore_matched_secret(instance, attr, matched)
+          instance.public_send(:"#{attr}=", matched)
+        end
+
+        # ORM hook: writes the upgraded value to storage and answers whether
+        # it was written.
+        #
+        # The upgrade is a write on what is otherwise a read path (finding a
+        # record by its secret), so the row can move between the match and
+        # this write — another request renewing the secret, or the
+        # application replacing it. An ORM can therefore make the write
+        # conditional on +attr+ still holding +matched+, answering false when
+        # it no longer does, as the Active Record implementation does
+        # (Doorkeeper::Orm::ActiveRecord::Mixins::SecretStorable). This
+        # default keeps the historical unconditional write for ORMs that have
+        # not implemented a conditional one.
+        #
+        # @param instance
+        #   The instance whose row to write, already carrying +upgraded+.
+        #
+        # @param attr
+        #   The secret attribute name being upgraded.
+        #
+        # @param matched
+        #   The stored value the fallback lookup matched.
+        #
+        # @param upgraded
+        #   The upgraded value to store, as returned by the strategy. The
+        #   instance carries it too, assigned through the attribute writer —
+        #   an implementation that writes past the writer should persist the
+        #   value the writer left on the instance rather than this one.
+        #
+        # @return [Boolean]
+        #   Whether the value was written.
+        #
+        def write_upgraded_secret(instance, attr, _matched, upgraded)
+          # The write must reach the primary database when automatic role
+          # switching would route the surrounding request to a read replica.
           if respond_to?(:with_primary_role)
             with_primary_role { instance.update(attr => upgraded) }
           else

data/lib/doorkeeper/oauth/authorization/token.rb

@@ -24,15 +24,72 @@ module Doorkeeper
             )
           end
 
-          def access_token_expires_in(configuration, context)
-            if configuration.option_defined?(:custom_access_token_expires_in)
-              expiration = configuration.custom_access_token_expires_in.call(context)
-              return nil if expiration == Float::INFINITY
+          # TTL for a new access token issued in +context+.
+          #
+          # When +custom_access_token_expires_in+ is configured and returns a
+          # value, that value is used (+Float::INFINITY+ meaning "never
+          # expires"). Otherwise the block, when given, supplies the TTL, and
+          # without a block it is +access_token_expires_in+.
+          #
+          # Whatever the source, the result is then capped for a public client
+          # by +public_client_access_token_expires_in+ (see
+          # +cap_for_public_client+).
+          #
+          # @yieldreturn [Integer, nil] the TTL to fall back to when no custom
+          #   expiration applies (the refresh_token grant passes the TTL of the
+          #   token being refreshed here).
+          def access_token_expires_in(configuration, context, &fallback)
+            fallback ||= -> { configuration.access_token_expires_in }
+
+            expires_in = if configuration.option_defined?(:custom_access_token_expires_in)
+                           expiration = configuration.custom_access_token_expires_in.call(context)
+                           expiration == Float::INFINITY ? nil : (expiration || fallback.call)
+                         else
+                           fallback.call
+                         end
+
+            cap_for_public_client(configuration, context.client, expires_in)
+          end
 
-              expiration || configuration.access_token_expires_in
-            else
-              configuration.access_token_expires_in
-            end
+          # OAuth 2.1 (draft-ietf-oauth-v2-1-15) Section 2.4: the authorization
+          # server must limit the exposure of tokens issued to unauthenticated
+          # clients. When +public_client_access_token_expires_in+ is configured,
+          # +expires_in+ is capped to it unless +application+ is a confidential
+          # client. A request that carries no application (client
+          # authentication skipped) is treated as a public client, and so is a
+          # never-expiring TTL (nil), which becomes the cap.
+          #
+          # @param application [Doorkeeper::Application, nil]
+          # @param expires_in [Integer, String, nil] the TTL the configuration
+          #   would issue; a numeric String is compared as a number and
+          #   returned as given, for the ORM to cast
+          # @return [Integer, String, nil]
+          def cap_for_public_client(configuration, application, expires_in)
+            cap = public_client_expires_in_cap(configuration, application)
+            return expires_in if cap.nil?
+
+            [expires_in, cap].compact.min_by { |ttl| comparable_ttl(ttl) }
+          end
+
+          # Whether +access_token+, found for reuse (+reuse_access_token+), can
+          # be handed out again to +application+ without exceeding
+          # +public_client_access_token_expires_in+. A token issued before the
+          # cap was configured, or while the application was still
+          # confidential, can outlive it. What counts is the lifetime the token
+          # has left, since that is what handing it out again exposes; a
+          # never-expiring token never fits under a cap. An ORM extension with
+          # its own +find_or_create_for+ should apply the same check to its
+          # reuse candidates.
+          #
+          # @param application [Doorkeeper::Application, nil]
+          # @param access_token [Doorkeeper::AccessToken] the candidate for reuse
+          # @return [Boolean]
+          def within_public_client_expires_in?(configuration, application, access_token)
+            cap = public_client_expires_in_cap(configuration, application)
+            return true if cap.nil?
+            return false if access_token.expires_in.nil?
+
+            access_token.expires_in_seconds <= comparable_ttl(cap)
           end
 
           def refresh_token_enabled?(server, context)
@@ -42,6 +99,28 @@ module Doorkeeper
               !!server.refresh_token_enabled?
             end
           end
+
+          private
+
+          # The cap +public_client_access_token_expires_in+ puts on tokens
+          # issued to +application+, or nil when none applies.
+          def public_client_expires_in_cap(configuration, application)
+            cap = configuration.public_client_access_token_expires_in
+            return if cap.nil?
+            return if application.respond_to?(:confidential?) && application.confidential?
+
+            cap
+          end
+
+          # A TTL can arrive as a numeric String: read from ENV without #to_i,
+          # or returned by a +custom_access_token_expires_in+ callable. The ORM
+          # casts it on write, but compared as is it raises against an Integer,
+          # and two Strings compare lexicographically ("86400" < "900"). It is
+          # compared the way the ORM casts it (#to_i), so the value compared is
+          # the value stored.
+          def comparable_ttl(ttl)
+            ttl.is_a?(String) ? ttl.to_i : ttl
+          end
         end
 
         def initialize(pre_auth, resource_owner)

data/lib/doorkeeper/oauth/client_authentication/client_secret_basic.rb

@@ -32,6 +32,19 @@ module Doorkeeper
           client_id, client_secret = credentials_from(request)
           return unless client_id
 
+          # RFC 7521 §4.2: a client_id parameter sent alongside another
+          # authentication method must agree with the identity that method
+          # establishes — the same check PrivateKeyJwt applies to an
+          # assertion's issuer. A request carrying credentials for one client
+          # and a client_id naming another presents two client identities and
+          # authenticates neither: without this it would be authenticated as
+          # the Basic client while the body asked to act as a different one,
+          # with nothing signalling the mismatch. A bare client_id is not an
+          # authentication method of its own, so +validate_client_authentication!+
+          # deliberately doesn't count it and cannot catch this.
+          request_client_id = request.request_parameters["client_id"] || request.request_parameters[:client_id]
+          return if request_client_id.present? && request_client_id != client_id
+
           Doorkeeper::ClientAuthentication::Credentials.new(client_id, client_secret)
         end
 

data/lib/doorkeeper/oauth/client_authentication/private_key_jwt.rb

@@ -53,6 +53,17 @@ module Doorkeeper
         def self.authenticate(request)
           require_jwt!
 
+          # A server that identifies itself nowhere has no audience to check
+          # an assertion against, and aud is the only claim that ties one to
+          # this server rather than to another one. Nothing can authenticate
+          # against an empty list, so the assertion is refused here rather
+          # than after the client has been looked up and its keys resolved —
+          # which, for a client published through a jwks_uri, would mean an
+          # outbound request on every cache miss for an authentication that
+          # cannot succeed.
+          audiences = acceptable_audiences(request)
+          return if audiences.empty?
+
           params = request.request_parameters.with_indifferent_access
           assertion = params[:client_assertion].to_s
 
@@ -68,7 +79,7 @@ module Doorkeeper
           jwk_set = KeyResolver.jwk_set_for(application)
           return unless jwk_set
 
-          claims = verified_claims(assertion, client_id, jwk_set, request)
+          claims = verified_claims(assertion, client_id, jwk_set, audiences)
           return unless claims
           return unless replay_guard.first_use?(
             "#{client_id}:#{claims["jti"]}",
@@ -104,7 +115,7 @@ module Doorkeeper
         end
         private_class_method :unverified_client_id
 
-        def self.verified_claims(assertion, client_id, jwk_set, request)
+        def self.verified_claims(assertion, client_id, jwk_set, audiences)
           claims, = ::JWT.decode(
             assertion,
             nil,
@@ -116,7 +127,7 @@ module Doorkeeper
             verify_iss: true,
             sub: client_id,
             verify_sub: true,
-            aud: acceptable_audiences(request),
+            aud: audiences,
             verify_aud: true,
             # Passed explicitly so a host application that globally disabled
             # expiration checking for its own tokens (JWT.configuration.decode)
@@ -152,29 +163,25 @@ module Doorkeeper
         # token endpoint URL is accepted at the revocation and introspection
         # endpoints too, not just at the endpoint being called.
         #
-        # The endpoint URLs are built from the server's own configured
+        # Every acceptable value is built from the server's own configured
         # identity, never from the request: aud is what keeps an assertion
         # minted for another authorization server from being replayed here, so
-        # deriving it from the client-supplied Host header would defeat its
-        # purpose on any deployment that does not filter hosts. Only a server
-        # that identifies itself nowhere falls back to the request, which is
-        # how MetadataResponse derives its issuer as well.
+        # deriving it from the client-supplied Host header would let whoever
+        # sends the assertion choose the audience it is checked against. A
+        # server that identifies itself nowhere therefore accepts no audience
+        # at all, and is warned about that at boot.
         def self.acceptable_audiences(request)
-          options = server_url_options(request)
+          audiences = [Doorkeeper.config.issuer.presence]
+          options = configured_url_options
 
-          [
-            Doorkeeper.config.issuer.presence,
-            "#{base_url(options)}#{request.path}",
-            token_endpoint_url(options),
-          ].compact.uniq
-        end
-        private_class_method :acceptable_audiences
+          if options
+            audiences << "#{base_url(options)}#{request.path}"
+            audiences << token_endpoint_url(options)
+          end
 
-        def self.server_url_options(request)
-          configured_url_options ||
-            { protocol: request.protocol, host: request.host, port: request.optional_port }
+          audiences.compact.uniq
         end
-        private_class_method :server_url_options
+        private_class_method :acceptable_audiences
 
         # An explicitly configured canonical host wins; failing that, the
         # issuer, when it is an absolute URL (Doorkeeper allows any string).