v0.15 is out: rules that were silently dropped on the shipped engine now run, and scans skip your test and mock files by default. Read more →
MEDIUM AI PREVALENCE: MEDIUM auth.jwt.jose-no-issuer

A JWT is verified with jose jwtVerify(...) but no issuer option is passed, so the iss claim is never checked.

Why AI tools produce this: AI coding tools produce this regularly, typically when prompted for a shortcut or a quick fix.

Why this matters

Any authorization server the key material chains to (or an attacker who controls one issuer in a multi-issuer setup) can mint a token this server will accept: an authorization-server mix-up (CWE-345), the class RFC 9207 exists to close.

Pin the issuer you trust: await jwtVerify(token, JWKS, { issuer: 'https://auth.example.com', audience: 'https://mcp.example.com/mcp', });

VULNERABLE
vulnerable.ts
import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(new URL('https://auth.example.com/.well-known/jwks.json'));

export async function verify(token: string) {
  // ruleid: auth.jwt.jose-no-issuer
  const { payload } = await jwtVerify(token, JWKS, { audience: 'https://mcp.example.com/mcp' });
  return payload;
}
SAFE
safe.ts
import { createRemoteJWKSet, jwtVerify } from 'jose';

const JWKS = createRemoteJWKSet(new URL('https://auth.example.com/.well-known/jwks.json'));

export async function verify(token: string) {
  // ok: auth.jwt.jose-no-issuer
  const { payload } = await jwtVerify(token, JWKS, {
    issuer: 'https://auth.example.com',
    audience: 'https://mcp.example.com/mcp',
  });
  return payload;
}

Suppressing this rule

If a finding is a genuine false positive, scope the suppression to the exact line and leave a reason, never disable the rule project-wide. Disable directives are line-scoped by design.

// oauthlint-disable-next-line auth.jwt.jose-no-issuer -- <reason>

References

https://datatracker.ietf.org/doc/html/rfc9207 ↗https://datatracker.ietf.org/doc/html/rfc9068 ↗https://datatracker.ietf.org/doc/html/rfc7519#section-4.1.1 ↗