OAUTH2_JWT_ISSUER_MISMATCH security auth_error ai_generated true

OAuth2 JWT issuer mismatch allows token forgery

ID: security/oauth2-jwt-issuer-mismatch-allows-token-forgery

Also available as: JSON · Markdown · 中文
90%Fix Rate
84%Confidence
1Evidence
2024-03-05First Seen

Version Compatibility

VersionStatusIntroducedDeprecatedNotes
JWT active — — —
Spring Security 5.7+ active — — —
Keycloak 22.0.0 active — — —
Auth0 2024.01 active — — —

Root Cause

When a JWT token's 'iss' (issuer) claim does not match the expected identity provider, the token could be forged by an attacker using a different issuer, bypassing authentication if the validation is not enforced.

generic

中文

当JWT令牌的'iss'（签发者）声明与预期的身份提供者不匹配时，攻击者可以使用不同的签发者伪造令牌，如果未强制执行验证，则会绕过身份验证。

Official Documentation

https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1

Workarounds

  1. 95% success Validate the 'iss' claim against a whitelist of trusted issuers. Example in Java with Spring Security: JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); converter.setJwtGrantedAuthoritiesConverter(jwt -> { if (!trustedIssuers.contains(jwt.getIssuer())) throw new AuthenticationException(); ... }); 
    Validate the 'iss' claim against a whitelist of trusted issuers. Example in Java with Spring Security: JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); converter.setJwtGrantedAuthoritiesConverter(jwt -> { if (!trustedIssuers.contains(jwt.getIssuer())) throw new AuthenticationException(); ... });
  2. 90% success Use OpenID Connect Discovery to fetch the issuer's configuration and validate against it dynamically. Example: jwks_uri from .well-known/openid-configuration. 
    Use OpenID Connect Discovery to fetch the issuer's configuration and validate against it dynamically. Example: jwks_uri from .well-known/openid-configuration.
  3. 85% success Ensure the JWT library enforces issuer validation (e.g., in jose-jwt library: JwtConsumer.builder().setExpectedIssuer('https://my-idp.com').build()). 
    Ensure the JWT library enforces issuer validation (e.g., in jose-jwt library: JwtConsumer.builder().setExpectedIssuer('https://my-idp.com').build()).

中文步骤

  1. Validate the 'iss' claim against a whitelist of trusted issuers. Example in Java with Spring Security: JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); converter.setJwtGrantedAuthoritiesConverter(jwt -> { if (!trustedIssuers.contains(jwt.getIssuer())) throw new AuthenticationException(); ... });
  2. Use OpenID Connect Discovery to fetch the issuer's configuration and validate against it dynamically. Example: jwks_uri from .well-known/openid-configuration.
  3. Ensure the JWT library enforces issuer validation (e.g., in jose-jwt library: JwtConsumer.builder().setExpectedIssuer('https://my-idp.com').build()).

Dead Ends

Common approaches that don't work:

  1. 70% fail

    Relying solely on signature validation is insufficient because an attacker can sign a token with a different issuer's key if the public key is obtained from an untrusted source.

  2. 80% fail

    Ignoring the issuer claim entirely and only validating the audience (aud) claim allows tokens from any issuer to be accepted.

  3. 60% fail

    Using a hardcoded issuer value in code without checking the token's actual issuer is bypassed if the token's iss is different.