fix: improve token issuer validation

Author: Pavel910

packages/auth0/src/api/features/Auth0Idp/Auth0IdpProviderFactory.ts

@@ -19,7 +19,7 @@ class Auth0IdpProviderFactoryImpl implements IdpProviderFactory.Interface {
                         return false;
                     }
 
-                    return new URL(issuer).hostname.includes("auth0.com") ?? false;
+                    return new URL(issuer).hostname.endsWith(".auth0.com") ?? false;
                 }
             },
             jwksCache

packages/cognito/src/api/features/CognitoIdp/CognitoIdpProviderFactory.ts

@@ -13,11 +13,11 @@ class CognitoIdpProviderFactoryImpl implements IdpProviderFactory.Interface {
         const clientId = String(process.env.COGNITO_CLIENT_ID);
 
         // Cognito issuer format: https://cognito-idp.{region}.amazonaws.com/{userPoolId}
-        const issuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
+        const expectedIssuer = `https://cognito-idp.${region}.amazonaws.com/${userPoolId}`;
 
         return new OidcIdpProvider(
             {
-                issuer,
+                issuer: expectedIssuer,
                 clientId,
                 config: this.config,
                 isApplicable: (token: JwtPayload) => {
@@ -26,12 +26,7 @@ class CognitoIdpProviderFactoryImpl implements IdpProviderFactory.Interface {
                         return false;
                     }
 
-                    const url = new URL(issuer);
-
-                    return (
-                        url.hostname.includes("cognito-idp") ||
-                        url.hostname.includes("amazonaws.com")
-                    );
+                    return issuer === expectedIssuer;
                 }
             },
             jwksCache

packages/okta/src/api/features/OktaIdp/OktaIdpProviderFactory.ts

@@ -19,7 +19,7 @@ class OktaIdpProviderFactoryImpl implements IdpProviderFactory.Interface {
                         return false;
                     }
 
-                    return new URL(issuer).hostname.includes("okta.com") ?? false;
+                    return new URL(issuer).hostname.endsWith(".okta.com") ?? false;
                 }
             },
             jwksCache