JWT_ISSUER_NOT_TRUSTED security auth_error ai_generated true

JWT验证失败：签发者'https://evil.example.com'不在受信任的签发者列表中

JWT validation failed: issuer 'https://evil.example.com' is not in the list of trusted issuers

ID: security/oauth2-jwt-issuer-not-trusted

其他格式: JSON · Markdown 中文 · English
90%修复率
86%置信度
1证据数
2023-10-05首次发现

版本兼容性

版本状态引入弃用备注
Spring Security 6.1.0 active — — —
Microsoft.IdentityModel 7.0.0 active — — —
PyJWT 2.8.0 active — — —
Auth0 Java SDK 2.0.0 active — — —

根因分析

JWT的'iss'（签发者）声明与配置的任何受信任签发者不匹配，通常是由于应用程序配置错误或使用了来自不同身份提供者的令牌。

English

The JWT's 'iss' (issuer) claim does not match any of the configured trusted issuers, often due to a misconfiguration in the application or a token from a different identity provider being used.

generic

官方文档

https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1

解决方案

  1. 更新应用程序配置以包含正确的签发者。例如，在Spring Boot应用程序中，设置`spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`。
  2. 验证令牌是否从正确的身份提供者获取。检查OAuth2客户端配置中的授权服务器URL，确保其与令牌的签发者声明匹配。
  3. 如果使用多租户设置，确保签发者验证逻辑是租户感知的，并为每个租户使用正确的签发者。

无效尝试

常见但无效的做法:

  1. 100% 失败

    Adding the attacker's issuer to the trusted list is a severe security vulnerability, as it would allow tokens from any source to be accepted, defeating the purpose of validation.

  2. 90% 失败

    Disabling issuer validation entirely removes the check, allowing tokens from any issuer to be accepted, which is a critical security flaw.

  3. 80% 失败

    Changing the token's issuer claim client-side to match the trusted list is impossible because the token is signed, and altering it will cause signature validation to fail.