JWT_ISSUER_MISMATCH security auth_error ai_generated true

JWT 签发者不匹配：令牌的 'iss' 声明与该应用程序的预期签发者不匹配

JWT issuer mismatch: token 'iss' claim does not match the expected issuer for this application

ID: security/jwt-issuer-mismatch-allows-token-forgery

其他格式: JSON · Markdown 中文 · English
90%修复率
88%置信度
1证据数
2024-01-10首次发现

版本兼容性

版本状态引入弃用备注
jsonwebtoken 9.0.0 active — — —
PyJWT 2.8.0 active — — —
jjwt 0.12.0 active — — —
Keycloak 22.0.0 active — — —
Auth0 JWT 1.0.0 active — — —

根因分析

JWT 验证未检查 'iss'（签发者）声明，允许攻击者从另一个受信任的签发者（例如受损的内部服务）伪造令牌以访问资源。

English

JWT validation does not verify the 'iss' (issuer) claim, allowing an attacker to forge a token from a different, trusted issuer (e.g., a compromised internal service) to access resources.

generic

官方文档

https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1

解决方案

  1. Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.
  2. Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.

无效尝试

常见但无效的做法:

  1. 80% 失败

    Audience claim checks the intended recipient, not the issuer; an attacker can still forge a token from a different issuer with a matching audience.

  2. 90% 失败

    Whitelisting all issuers defeats the purpose; an attacker can use any trusted issuer's signing key to forge tokens.

  3. 99% 失败

    Completely bypasses the security check, making the application vulnerable to cross-issuer token forgery.