fix: default to allowing missing issuer - #1051
Merged
Merged
Conversation
github-actions
Bot
added
T-core
jamadeo
marked this pull request as ready for review
July 25, 2026 00:35
alexhancock
approved these changes
Jul 27, 2026
| /// authorization servers that omit `issuer`. Set this to `true` to enforce | ||
| /// the RFC 8414/OIDC requirement that discovered metadata include `issuer` | ||
| /// whenever the expected issuer can be derived from the discovery URL. | ||
| pub fn set_strict_issuer_validation(&mut self, strict: bool) { |
Contributor
There was a problem hiding this comment.
Should we provide a public setter, or just announce the change and change the default at some point in the future? Providing a setter suggests to people they could set it to false and leave it that way when my understanding of this is that we'll want to eventually always require it.
Contributor
Author
There was a problem hiding this comment.
I think once we are at the point where we remove non-compliant server support, we'd remove the setter completely and that forces users to change their code anyway.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
fixes #1047
Motivation and Context
Strictly compliant servers must send
issuer, but to preserver legacy compatibility, default to allowing missing.How Has This Been Tested?
Breaking Changes
Types of changes
Checklist
Additional context