JWT_ISSUER_MISMATCH security auth_error ai_generated true

JWT issuer mismatch: token 'iss' claim does not match the expected issuer for this application

ID: security/jwt-issuer-mismatch-allows-token-forgery

Also available as: JSON · Markdown · 中文
90%Fix Rate
88%Confidence
1Evidence
2024-01-10First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
jsonwebtoken 9.0.0 active — — —
PyJWT 2.8.0 active — — —
jjwt 0.12.0 active — — —
Keycloak 22.0.0 active — — —
Auth0 JWT 1.0.0 active — — —

Root Cause

JWT validation does not verify the 'iss' (issuer) claim, allowing an attacker to forge a token from a different, trusted issuer (e.g., a compromised internal service) to access resources.

generic

中文

JWT 验证未检查 'iss'（签发者）声明，允许攻击者从另一个受信任的签发者（例如受损的内部服务）伪造令牌以访问资源。

Official Documentation

https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1

Workarounds

  1. 95% success Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment. 
    Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.
  2. 90% success Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider. 
    Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.

中文步骤

  1. Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.
  2. Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.

Dead Ends

Common approaches that don't work:

  1. 80% fail

    Audience claim checks the intended recipient, not the issuer; an attacker can still forge a token from a different issuer with a matching audience.

  2. 90% fail

    Whitelisting all issuers defeats the purpose; an attacker can use any trusted issuer's signing key to forge tokens.

  3. 99% fail

    Completely bypasses the security check, making the application vulnerable to cross-issuer token forgery.