Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.
Why this matters
With the issuer unchecked, a token from any issuer or identity provider is accepted, so an attacker who controls (or spins up) any IdP can mint tokens this service will trust (CWE-287). This is a common AI-generated shortcut: the check is disabled to get past an iss mismatch during setup and never restored.
Leave ValidateIssuer at its secure default (true) and pin the expected issuer with ValidIssuer (or ValidIssuers) so only tokens from your own authority are honored.
VULNERABLE
vulnerable.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateAudience = true, ValidateLifetime = true, // ruleid: auth.csharp.jwt.validate-issuer-disabled ValidateIssuer = false, }; }); }}
SAFE
safe.cs
using Microsoft.AspNetCore.Authentication.JwtBearer;using Microsoft.Extensions.DependencyInjection;using Microsoft.IdentityModel.Tokens;public class Startup{ // An OIDC framework validates the issuer itself, outside any JWT bearer // registration. Disabling the built-in check here is deliberate, so it must // NOT fire (no AddJwtBearer context). public static readonly TokenValidationParameters FrameworkDefaults = new TokenValidationParameters { ValidateIssuer = false, }; public void ConfigureServices(IServiceCollection services) { services.AddAuthentication().AddJwtBearer(options => { options.TokenValidationParameters = new TokenValidationParameters { ValidateIssuer = true, ValidIssuer = "https://issuer.example.com", }; }); }}
Suppressing this rule
If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.