# JWT 签发者不匹配：令牌的 'iss' 声明与该应用程序的预期签发者不匹配

- **ID:** `security/jwt-issuer-mismatch-allows-token-forgery`
- **领域:** security
- **类别:** auth_error
- **错误码:** `JWT_ISSUER_MISMATCH`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

JWT 验证未检查 'iss'（签发者）声明，允许攻击者从另一个受信任的签发者（例如受损的内部服务）伪造令牌以访问资源。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| jsonwebtoken 9.0.0 | active | — | — |
| PyJWT 2.8.0 | active | — | — |
| jjwt 0.12.0 | active | — | — |
| Keycloak 22.0.0 | active | — | — |
| Auth0 JWT 1.0.0 | active | — | — |

## 解决方案

1. ```
   Add issuer validation in JWT verification middleware. Example in Node.js using jsonwebtoken library: `jwt.verify(token, secret, { issuer: 'https://auth.myapp.com' })`. Ensure the expected issuer is configured per environment.
   ```
2. ```
   Use OpenID Connect Discovery to fetch and validate issuer dynamically: verify `iss` matches the issuer URL of the identity provider.
   ```

## 无效尝试

- **** — Audience claim checks the intended recipient, not the issuer; an attacker can still forge a token from a different issuer with a matching audience. (80% 失败率)
- **** — Whitelisting all issuers defeats the purpose; an attacker can use any trusted issuer's signing key to forge tokens. (90% 失败率)
- **** — Completely bypasses the security check, making the application vulnerable to cross-issuer token forgery. (99% 失败率)