# JWT验证失败：签发者'https://evil.example.com'不在受信任的签发者列表中

- **ID:** `security/oauth2-jwt-issuer-not-trusted`
- **领域:** security
- **类别:** auth_error
- **错误码:** `JWT_ISSUER_NOT_TRUSTED`
- **验证级别:** ai_generated
- **修复率:** 90%

## 根因

JWT的'iss'（签发者）声明与配置的任何受信任签发者不匹配，通常是由于应用程序配置错误或使用了来自不同身份提供者的令牌。

## 版本兼容性

| 版本 | 状态 | 引入 | 弃用 |
|------|------|------|------|
| Spring Security 6.1.0 | active | — | — |
| Microsoft.IdentityModel 7.0.0 | active | — | — |
| PyJWT 2.8.0 | active | — | — |
| Auth0 Java SDK 2.0.0 | active | — | — |

## 解决方案

1. ```
   更新应用程序配置以包含正确的签发者。例如，在Spring Boot应用程序中，设置`spring.security.oauth2.resourceserver.jwt.issuer-uri=https://your-idp.com`。
   ```
2. ```
   验证令牌是否从正确的身份提供者获取。检查OAuth2客户端配置中的授权服务器URL，确保其与令牌的签发者声明匹配。
   ```
3. ```
   如果使用多租户设置，确保签发者验证逻辑是租户感知的，并为每个租户使用正确的签发者。
   ```

## 无效尝试

- **** — Adding the attacker's issuer to the trusted list is a severe security vulnerability, as it would allow tokens from any source to be accepted, defeating the purpose of validation. (100% 失败率)
- **** — Disabling issuer validation entirely removes the check, allowing tokens from any issuer to be accepted, which is a critical security flaw. (90% 失败率)
- **** — Changing the token's issuer claim client-side to match the trusted list is impossible because the token is signed, and altering it will cause signature validation to fail. (80% 失败率)