JWT validation failed: issuer 'https://evil.example.com' is not in the list of trusted issuers
ID: security/oauth2-jwt-issuer-not-trusted
Version Compatibility
| Version | Status | Introduced | Deprecated | Notes |
|---|---|---|---|---|
| Spring Security 6.1.0 | active | — | — | — |
| Microsoft.IdentityModel 7.0.0 | active | — | — | — |
| PyJWT 2.8.0 | active | — | — | — |
| Auth0 Java SDK 2.0.0 | active | — | — | — |
Root Cause
The JWT's 'iss' (issuer) claim does not match any of the configured trusted issuers, often due to a misconfiguration in the application or a token from a different identity provider being used.
generic中文
JWT的'iss'（签发者）声明与配置的任何受信任签发者不匹配，通常是由于应用程序配置错误或使用了来自不同身份提供者的令牌。
Official Documentation
https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1Workarounds
-
90% success Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.
Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.
-
85% success Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.
Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.
-
80% success If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.
If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.
中文步骤
更新应用程序配置以包含正确的签发者。例如，在Spring Boot应用程序中，设置`spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`。
验证令牌是否从正确的身份提供者获取。检查OAuth2客户端配置中的授权服务器URL，确保其与令牌的签发者声明匹配。
如果使用多租户设置，确保签发者验证逻辑是租户感知的，并为每个租户使用正确的签发者。
Dead Ends
Common approaches that don't work:
-
100% fail
Adding the attacker's issuer to the trusted list is a severe security vulnerability, as it would allow tokens from any source to be accepted, defeating the purpose of validation.
-
90% fail
Disabling issuer validation entirely removes the check, allowing tokens from any issuer to be accepted, which is a critical security flaw.
-
80% fail
Changing the token's issuer claim client-side to match the trusted list is impossible because the token is signed, and altering it will cause signature validation to fail.