Unable to accept Cognito Access Tokens

[xavfernandez]

Cognito access tokens are lacking the aud field (cf https://docs.aws.amazon.com/cognito/latest/developerguide/amazon-cognito-user-pools-using-tokens-with-identity-providers.html#amazon-cognito-user-pools-using-the-access-token) making their decoding impossible/invalid with this library since the audience is provided & expected at the decoding step: https://github.com/labd/django-cognito-jwt/blob/master/src/django_cognito_jwt/validator.py#L64.

Would you be willing to accept a PR making the audience optional ?

[martinzugnoni]

Same happening to me. Authentication works by providing the IdToken, but it doesn't using the normal AccessToken. I would rather use AccessToken because the IdToken contains some sensitive user data (like email, etc) that I would prefer not to send around in a token.

[danni]

Just a note: the module will accept the access token is the COGNITO_AUDIENCE setting is set to None.