validateAuthorizationResponseIssuer method

Future<void> validateAuthorizationResponseIssuer(
  1. String? responseIssuer
)

Validate the iss parameter returned on an authorization response against the authorization server's issuer (RFC 9207, MCP 2026-07-28 auth hardening). Defends against mix-up attacks: a response's iss MUST equal the discovered AS issuer. Throws OAuthError on mismatch. A null responseIssuer is tolerated only when the AS did not advertise authorization_response_iss_parameter_supported — callers that receive an iss MUST pass it.

Implementation

Future<void> validateAuthorizationResponseIssuer(
    String? responseIssuer) async {
  if (responseIssuer == null) return;
  final metadata = await _discoverMetadata();
  if (responseIssuer != metadata.issuer) {
    throw OAuthError(
      error: 'invalid_issuer',
      errorDescription:
          'Authorization response `iss` ($responseIssuer) does not match '
          'the authorization server issuer (${metadata.issuer}) — RFC 9207.',
    );
  }
}