79104288

Date: 2024-10-19 05:54:20
Score: 1
Natty:
Report link

Skipping issuer check altogether should be considered a security issue, as then one has no guarantee if the token was issued by the right party. It would affect other clients which would have less strict token validation and introduce possibility to pass token issued by any party for the problematic client.

If there is absolutely no possibility to get it right, I'd rather suggest a solution in which you can handle white-listed exceptions.

Most of the back-end authentication libraries have possibility to hook into the token validation process and introduce custom validation logic. Your logic could be "if is token for client X, check if issuer field matches white-listed exception/override for X". Store your white-list as back-end configuration and you're good to go.

Reasons:
  • Long answer (-0.5):
  • No code block (0.5):
  • Low reputation (1):
Posted by: krzychuz