pass issuer to validate

docs/index.md

@@ -127,6 +127,8 @@ JWT_AUTH = {
     'JWT_VERIFY_EXPIRATION': True,
     'JWT_LEEWAY': 0,
     'JWT_EXPIRATION_DELTA': datetime.timedelta(seconds=300),
+    'JWT_AUDIENCE': None,
+    'JWT_ISSUER': None,
 
     'JWT_ALLOW_REFRESH': False,
     'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=7),
@@ -182,6 +184,16 @@ This is an instance of Python's `datetime.timedelta`. This will be added to `dat
 
 Default is `datetime.timedelta(seconds=300)`(5 minutes).
 
+### JWT_AUDIENCE
+This is a string that will be checked against the `aud` field of the token, if present.
+
+Default is `None`(fail if `aud` present on JWT).
+
+### JWT_ISSUER
+This is a string that will be checked against the `iss` field of the token.
+
+Default is `None`(do not check `iss` on JWT).
+
 ### JWT_ALLOW_REFRESH
 Enable token refresh functionality. Token issued from `rest_framework_jwt.views.obtain_jwt_token` will have an `orig_iat` field. Default is `False`
 

rest_framework_jwt/settings.py

@@ -28,13 +28,13 @@
     'JWT_VERIFY_EXPIRATION': True,
     'JWT_LEEWAY': 0,
     'JWT_EXPIRATION_DELTA': datetime.timedelta(seconds=300),
+    'JWT_AUDIENCE': None,
+    'JWT_ISSUER': None,
 
     'JWT_ALLOW_REFRESH': False,
     'JWT_REFRESH_EXPIRATION_DELTA': datetime.timedelta(days=7),
 
     'JWT_AUTH_HEADER_PREFIX': 'JWT',
-
-    'JWT_AUDIENCE': None,
 }
 
 # List of settings that may be in string import notation.

rest_framework_jwt/utils.py

@@ -53,7 +53,8 @@ def jwt_decode_handler(token):
         api_settings.JWT_VERIFY,
         verify_expiration=api_settings.JWT_VERIFY_EXPIRATION,
         leeway=api_settings.JWT_LEEWAY,
-        audience=api_settings.JWT_AUDIENCE
+        audience=api_settings.JWT_AUDIENCE,
+        issuer=api_settings.JWT_ISSUER
     )