# OAuth2 JWT签发者不匹配允许令牌伪造

- **ID:** `security/oauth2-jwt-issuer-mismatch-allows-token-forgery`
- **领域:** security
- **类别:** auth_error
- **错误码:** `OAUTH2_JWT_ISSUER_MISMATCH`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

当JWT令牌的'iss'（签发者）声明与预期的身份提供者不匹配时，攻击者可以使用不同的签发者伪造令牌，如果未强制执行验证，则会绕过身份验证。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| JWT | active | — | — |
| Spring Security 5.7+ | active | — | — |
| Keycloak 22.0.0 | active | — | — |
| Auth0 2024.01 | active | — | — |

## 解决方案

1. ```
   Validate the 'iss' claim against a whitelist of trusted issuers. Example in Java with Spring Security: JwtAuthenticationConverter converter = new JwtAuthenticationConverter(); converter.setJwtGrantedAuthoritiesConverter(jwt -> { if (!trustedIssuers.contains(jwt.getIssuer())) throw new AuthenticationException(); ... });
   ```
2. ```
   Use OpenID Connect Discovery to fetch the issuer's configuration and validate against it dynamically. Example: jwks_uri from .well-known/openid-configuration.
   ```
3. ```
   Ensure the JWT library enforces issuer validation (e.g., in jose-jwt library: JwtConsumer.builder().setExpectedIssuer('https://my-idp.com').build()).
   ```

## 无效尝试

- **** — Relying solely on signature validation is insufficient because an attacker can sign a token with a different issuer's key if the public key is obtained from an untrusted source. (70% 失败率)
- **** — Ignoring the issuer claim entirely and only validating the audience (aud) claim allows tokens from any issuer to be accepted. (80% 失败率)
- **** — Using a hardcoded issuer value in code without checking the token's actual issuer is bypassed if the token's iss is different. (60% 失败率)