#0806
JWT tokens carry an 'iss' (issuer) claim identifying who created the token. Your application should only trust tokens from known identity providers.
The validation function checks that iss exists but never verifies it against an allowlist.
An attacker can stand up their own identity provider, issue tokens with arbitrary claims, and access your API.
Without issuer validation, any party with knowledge of your JWT structure can issue valid-looking tokens, completely bypassing your identity provider.
validateIssuer({sub:'alice',iss:'evil.com'}, ['auth.myapp.com'])// Returns {valid:true, issuer:'evil.com'} — should throw!
validateIssuer({sub:'alice',iss:'auth.myapp.com'}, ['auth.myapp.com'])// Returns {valid:true, issuer:'auth.myapp.com'}