{"record":{"id":"6a6ae9ad76d44e35","repo":"lcobucci/jwt","slug":"the-token-was-not-issued-by-the-given-issuers","errorCode":null,"errorMessage":"The token was not issued by the given issuers","messagePattern":"The token was not issued by the given issuers","errorType":"validation","errorClass":"ConstraintViolation","httpStatus":null,"severity":"error","filePath":"src/Validation/Constraint/IssuedBy.php","lineNumber":24,"sourceCode":"use Lcobucci\\JWT\\Token;\nuse Lcobucci\\JWT\\Validation\\Constraint;\nuse Lcobucci\\JWT\\Validation\\ConstraintViolation;\n\nfinal readonly class IssuedBy implements Constraint\n{\n    /** @var non-empty-string[] */\n    private array $issuers;\n\n    /** @param non-empty-string ...$issuers */\n    public function __construct(string ...$issuers)\n    {\n        $this->issuers = $issuers;\n    }\n\n    public function assert(Token $token): void\n    {\n        if (! $token->hasBeenIssuedBy(...$this->issuers)) {\n            throw ConstraintViolation::error(\n                'The token was not issued by the given issuers',\n                $this,\n            );\n        }\n    }\n}\n","sourceCodeStart":6,"sourceCodeEnd":31,"githubUrl":"https://github.com/lcobucci/jwt/blob/375813049c24c7111bda8b6884c57b071ceb2fe7/src/Validation/Constraint/IssuedBy.php#L6-L31","documentation":"This ConstraintViolation is thrown by the IssuedBy validation constraint. It fires when the token's `iss` (issuer) claim is missing or is not one of the issuer values configured in the constraint. The library throws it so applications can reject tokens minted by an authority they do not trust.","triggerScenarios":"Calling IssuedByConstraint::assert($token) where Token::hasBeenIssuedBy(...$this->issuers) returns false — the token has no `iss` claim, or its `iss` value/type does not exactly match any of the issuer strings given to the constraint's constructor.","commonSituations":"Multi-tenant setups where each tenant issues tokens with a different `iss` but validation uses a single hard-coded issuer; issuer URLs mismatched by trailing slash, scheme (http vs https) or case; migrating the issuer identifier (e.g. new domain) while old tokens are still in circulation; tokens built without ->issuedBy(...) at all.","solutions":["Ensure tokens are minted with ->issuedBy('https://your-issuer.example.com') matching the configured value exactly.","Pass every acceptable issuer to the constraint: IssuedBy::constraint('https://old-issuer', 'https://new-issuer').","Compare the token's `iss` ($token->claims()->get('iss')) with the configured issuers byte-for-byte (scheme, host, path, no trailing slash difference).","If issuer verification is not required for this use case, drop the IssuedBy constraint from the validator configuration."],"exampleFix":"// before: issuer mismatch (trailing slash)\n$constraint = new IssuedBy('https://issuer.example.com/');\n\n// after: exact issuer as embedded in the token\n$constraint = new IssuedBy('https://issuer.example.com');","handlingStrategy":"try-catch","validationCode":"$iss = $token->claims()->get('iss');\nif (! is_string($iss) || ! in_array($iss, $allowedIssuers, true)) {\n    // reject before calling the constraint\n}","typeGuard":"function issuedByAllowed(Lcobucci\\JWT\\Token $token, array $allowedIssuers): bool\n{\n    $iss = $token->claims()->get('iss');\n    return is_string($iss) && in_array($iss, $allowedIssuers, true);\n}","tryCatchPattern":"try {\n    $validator->assert($token, $constraints);\n} catch (Lcobucci\\JWT\\Validation\\ConstraintViolation $e) {\n    if ($e->getConstraint() instanceof Lcobucci\\JWT\\Validation\\Constraint\\IssuedBy) {\n        // untrusted issuer: reject with 401\n    }\n}","preventionTips":["Keep the list of trusted issuers in configuration and pass all of them to IssuedBy.","Normalize issuer URLs (no trailing slash, consistent scheme) at issuance and validation time.","When migrating issuer domains, accept old and new issuers during a transition window.","Mint tokens with ->issuedBy() using the exact same string you validate against."],"tags":["jwt","validation-constraint","issuer"],"backgroundTag":"schema-validation-failed","analyzedSha":"375813049c24c7111bda8b6884c57b071ceb2fe7","analyzedAt":"2026-09-14T11:12:28.004Z","contentChangedAt":"2026-09-14T11:12:28.004Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}