checkAuthorizationResponseIssuer function

void checkAuthorizationResponseIssuer({ required String recordedIssuer, required bool issParameterSupported, required String? iss, })

RFC 9207 §2.4 as MCP applies it: a present iss must equal the recorded issuer exactly (no normalization); an absent one is refused only when the server said it sends one. Throws OAuthError otherwise.

Implementation

void checkAuthorizationResponseIssuer({
  required String recordedIssuer,
  required bool issParameterSupported,
  required String? iss,
}) {
  if (iss == null) {
    if (issParameterSupported) {
      throw const OAuthError(
          error: 'invalid_issuer', errorDescription: 'The authorization response carries no iss');
    }
    return;
  }
  if (iss != recordedIssuer) {
    throw OAuthError(
        error: 'invalid_issuer',
        errorDescription: 'The authorization response came from $iss, not $recordedIssuer');
  }
}