JWT tokens issued with empty subject
Closed, DuplicatePublic
Actions

Assigned To

None

Authored By

	Vgutierrez
	Mar 4 2026, 10:49 AM

Project Tags

Referenced Files

None

Subscribers

Description

We are seeing tokens issued by meta.wikimedia.org with an empty subject, this is impacting how the CDN is able to track the rate limits for these users

"iat": 1772619814.933524,
  "nbf": 1772619814.933528,
  "exp": 1772634214.927589,
  "sub": "",
  "iss": "https://meta.wikimedia.org",

Related Objects

Mentioned Here: T417278: Choosing client credentials grant for OAuth 2 results in an access token (JWT) with the 'sub' field empty

Event Timeline

Vgutierrez created this task.Mar 4 2026, 10:49 AM

Restricted Application added a subscriber: Aklapper. · View Herald TranscriptMar 4 2026, 10:49 AM

Vgutierrez triaged this task as High priority.Mar 4 2026, 10:49 AM

this seems to be tracked as T417278

Tgr closed this task as a duplicate of T417278: Choosing client credentials grant for OAuth 2 results in an access token (JWT) with the 'sub' field empty.Mar 4 2026, 10:56 AM

JWT tokens issued with empty subjectClosed, DuplicatePublicActions

Description

Related Objects

Event Timeline

JWT tokens issued with empty subject
Closed, DuplicatePublic
Actions