shreemaan-abhishek opened a new pull request, #13916: URL: https://github.com/apache/apisix/pull/13916
### Description When remote introspection was used, `claim_validator.issuer.valid_issuers` was not applied to the introspection result. This change validates the `iss` field of a successful introspection response when an issuer allowlist is explicitly configured. Missing and non-matching issuer values return 401 with a Bearer `invalid_token` challenge. Configurations without an explicit issuer allowlist keep the existing behavior. #### Which issue(s) this PR fixes: N/A ### Breaking changes For remote-introspection routes with an explicit issuer allowlist, the introspection response must now contain a string `iss` value that exactly matches one of the configured issuers. To retain the previous provider behavior, omit the issuer allowlist; otherwise configure the provider to include an allowed issuer in its response. ### Checklist - [x] I have explained the need for this PR and the problem it solves - [x] I have explained the changes or the new features added to this PR - [x] I have added tests corresponding to this change - [ ] I have updated the documentation to reflect this change - [ ] I have verified that this change is backward compatible (If not, please discuss on the [APISIX mailing list](https://github.com/apache/apisix/tree/master#community) first) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
