{
  "id": "security/oauth2-jwt-issuer-not-trusted",
  "signature": "JWT validation failed: issuer 'https://evil.example.com' is not in the list of trusted issuers",
  "signature_zh": "JWT验证失败：签发者'https://evil.example.com'不在受信任的签发者列表中",
  "regex": "JWT validation failed: issuer '.*' is not in the list of trusted issuers",
  "domain": "security",
  "category": "auth_error",
  "subcategory": null,
  "root_cause": "The JWT's 'iss' (issuer) claim does not match any of the configured trusted issuers, often due to a misconfiguration in the application or a token from a different identity provider being used.",
  "root_cause_type": "generic",
  "root_cause_zh": "JWT的'iss'（签发者）声明与配置的任何受信任签发者不匹配，通常是由于应用程序配置错误或使用了来自不同身份提供者的令牌。",
  "versions": [
    {
      "version": "Spring Security 6.1.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Microsoft.IdentityModel 7.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "PyJWT 2.8.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    },
    {
      "version": "Auth0 Java SDK 2.0.0",
      "introduced": null,
      "deprecated": null,
      "removed": null,
      "behavior_change": null,
      "status": "active"
    }
  ],
  "os_specific": {},
  "dead_ends": [
    {
      "action": "",
      "why_fails": "Adding the attacker's issuer to the trusted list is a severe security vulnerability, as it would allow tokens from any source to be accepted, defeating the purpose of validation.",
      "fail_rate": 1.0,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Disabling issuer validation entirely removes the check, allowing tokens from any issuer to be accepted, which is a critical security flaw.",
      "fail_rate": 0.9,
      "condition": "",
      "sources": []
    },
    {
      "action": "",
      "why_fails": "Changing the token's issuer claim client-side to match the trusted list is impossible because the token is signed, and altering it will cause signature validation to fail.",
      "fail_rate": 0.8,
      "condition": "",
      "sources": []
    }
  ],
  "workarounds": [
    {
      "action": "Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.",
      "success_rate": 0.9,
      "how": "Update the application configuration to include the correct issuer. For example, in a Spring Boot application, set `spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`.",
      "condition": "",
      "sources": []
    },
    {
      "action": "Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.",
      "success_rate": 0.85,
      "how": "Verify the token is being obtained from the correct identity provider. Check the authorization server URL in your OAuth2 client configuration and ensure it matches the token's issuer claim.",
      "condition": "",
      "sources": []
    },
    {
      "action": "If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.",
      "success_rate": 0.8,
      "how": "If using a multi-tenancy setup, ensure the issuer validation logic is tenant-aware and uses the correct issuer for each tenant.",
      "condition": "",
      "sources": []
    }
  ],
  "workarounds_zh": [
    "更新应用程序配置以包含正确的签发者。例如，在Spring Boot应用程序中，设置`spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`。",
    "验证令牌是否从正确的身份提供者获取。检查OAuth2客户端配置中的授权服务器URL，确保其与令牌的签发者声明匹配。",
    "如果使用多租户设置，确保签发者验证逻辑是租户感知的，并为每个租户使用正确的签发者。"
  ],
  "transition_graph": {
    "leads_to": [],
    "preceded_by": [],
    "frequently_confused_with": []
  },
  "official_doc_url": "https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1",
  "official_doc_section": null,
  "error_code": "JWT_ISSUER_NOT_TRUSTED",
  "verification_tier": "ai_generated",
  "confidence": 0.86,
  "fix_success_rate": 0.9,
  "resolvable": "true",
  "first_seen": "2023-10-05",
  "last_confirmed": "2024-06-01",
  "last_updated": "2024-06-01",
  "evidence_count": 1,
  "tags": [],
  "locale": "en",
  "aliases": []
}