From b1deb049c863082df0b0c600b47104a92043fac7 Mon Sep 17 00:00:00 2001
From: Wolfgang Walther <walther@technowledgy.de>
Date: Sun, 18 Feb 2024 18:21:55 +0100
Subject: [PATCH] docs: Clarify behavior of jwt-aud and tokens without aud
 claim

Resolves https://github.com/PostgREST/postgrest-docs/issues/479
---
 docs/references/configuration.rst | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/docs/references/configuration.rst b/docs/references/configuration.rst
index 775bb2c06..5a4fe2f38 100644
--- a/docs/references/configuration.rst
+++ b/docs/references/configuration.rst
@@ -569,6 +569,10 @@ jwt-aud
 
   Specifies the `JWT audience claim <https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.3>`_. If this claim is present in the client provided JWT then you must set this to the same value as in the JWT, otherwise verifying the JWT will fail.
 
+  .. warning::
+
+     Using this setting will only reject tokens with a different audience claim. Tokens **without** audience claim will still be accepted.
+
 .. _jwt-role-claim-key:
 
 jwt-role-claim-key