OAUTH2_JWT_ISSUER_MISMATCH security auth_error ai_generated true

OAuth2 JWT签发者不匹配允许令牌伪造

OAuth2 JWT issuer mismatch allows token forgery

ID: security/oauth2-jwt-issuer-mismatch-allows-token-forgery

其他格式: JSON · Markdown 中文 · English
90%修复率
84%置信度
1证据数
2024-03-05首次发现

版本兼容性

版本状态引入弃用备注
JWT active — — —
Spring Security 5.7+ active — — —
Keycloak 22.0.0 active — — —
Auth0 2024.01 active — — —

根因分析

当JWT令牌的'iss'（签发者）声明与预期的身份提供者不匹配时，攻击者可以使用不同的签发者伪造令牌，如果未强制执行验证，则会绕过身份验证。

English

When a JWT token's 'iss' (issuer) claim does not match the expected identity provider, the token could be forged by an attacker using a different issuer, bypassing authentication if the validation is not enforced.

generic

官方文档

https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1

解决方案

  1. Validate the 'iss' claim against a whitelist of trusted issuers. Example in Java with Spring Security: JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); converter.setJwtGrantedAuthoritiesConverter(jwt -> { if (!trustedIssuers.contains(jwt.getIssuer())) throw new AuthenticationException(); ... });
  2. Use OpenID Connect Discovery to fetch the issuer's configuration and validate against it dynamically. Example: jwks_uri from .well-known/openid-configuration.
  3. Ensure the JWT library enforces issuer validation (e.g., in jose-jwt library: JwtConsumer.builder().setExpectedIssuer('https://my-idp.com').build()).

无效尝试

常见但无效的做法:

  1. 70% 失败

    Relying solely on signature validation is insufficient because an attacker can sign a token with a different issuer's key if the public key is obtained from an untrusted source.

  2. 80% 失败

    Ignoring the issuer claim entirely and only validating the audience (aud) claim allows tokens from any issuer to be accepted.

  3. 60% 失败

    Using a hardcoded issuer value in code without checking the token's actual issuer is bypassed if the token's iss is different.