title: OpenID Connect ID Token: What's the purpose of audience [aud] field validation
body: <p>I'm trying to implement <a href="http://openid.net/specs/openid-connect-core-1_0.html#ImplicitFlowAuth" rel="noreferrer">OpenID Connect Implicit Flow</a>. The frontend Single Page App passes the ID Token down to the backend server (using Authorization header) where I need to validate it.</p>
  
  <p>The documentation requires me <a href="http://openid.net/specs/openid-connect-core-1_0.html#IDTokenValidation" rel="noreferrer">to check</a> that I trust the audience of the token (aud &amp; azp fields). I'm struggling to understand the significance of this validation step and what are the security implications of not doing so. Why should I distrust the token if I'm not the intended recipient?</p>
  
  <p>My reasoning is that if I trust the issuer it doesn't matter who was the token issued for. I would expect the claims to be the same for any clientId (is this wrong?). Ideally when I pass the ID Token around my microservices all they should know is what issuers to trust (and use <a href="https://openid.net/specs/openid-connect-discovery-1_0.html#ProviderConfig" rel="noreferrer">discovery protocol</a> for figuring out the keys).</p>
  
  <p>What is the attack vector if I skip this validation step?</p>