# OAuth Issuer Validation Learn how to validate the authorization response issuer parameter (RFC 9207) to prevent mix-up attacks. > For the index of this section of the site, see [llms.txt](https://fusionauth.io/docs/llms.txt) Available since `1.69.0` FusionAuth includes the `iss` parameter in authorization responses as defined by [RFC 9207 - OAuth 2.0 Authorization Server Issuer Identification](https://www.rfc-editor.org/rfc/rfc9207). This parameter helps clients prevent mix-up attacks when interacting with multiple authorization servers. ## Overview A mix-up attack occurs when a malicious authorization server tricks a client into sending an authorization code or tokens to the wrong endpoint. By including the `iss` parameter in every authorization response, the client can verify that the response came from the expected authorization server before proceeding with the token exchange. FusionAuth returns the `iss` parameter on all successful responses from the `/oauth2/authorize` endpoint, including both the Authorization Code Grant and Implicit Grant flows. ## The Issuer Value The value of the `iss` parameter is the issuer configured on the tenant. This value is treated as an opaque string for comparison purposes. Caution To be compliant with [RFC 9207 Section 2](https://www.rfc-editor.org/rfc/rfc9207#section-2), the issuer value must be a URL that uses the `https` scheme with no query or fragment components. If you intend to validate the `iss` parameter, configure your tenant issuer accordingly (e.g. `https://auth.example.com`). ## Validating the Issuer Clients should validate the `iss` parameter by comparing it against the authorization server's metadata. The expected issuer value can be obtained from the [OpenID Connect Discovery](https://fusionauth.io/docs/apis/oauth/openid-configuration.md) endpoint at `/.well-known/openid-configuration` in the `issuer` field. ### Validation Steps 1. Before initiating the authorization request, retrieve or cache the authorization server metadata from the `/.well-known/openid-configuration` endpoint. 2. When the authorization response is received (at your redirect URI), extract the `iss` parameter. 3. Compare the `iss` value from the response to the `issuer` value from the authorization server metadata using exact string comparison. 4. If the values do not match, reject the response and do not proceed with the token exchange. ### Example After a successful authorization code grant, the redirect to your application will include the `iss` parameter: ```plaintext GET /callback?code=pU2DHOWjSCVh6NJKi1ClhBYNKfuqbZVT &iss=https%3A%2F%2Fauth.example.com &state=abc123 ``` Your client should then verify: ```plaintext iss == metadata.issuer "https://auth.example.com" == "https://auth.example.com" ✓ ``` If you are using multiple authorization servers or identity providers, this check ensures the response originated from the authorization server from which the client expected to receive it. ## When To Validate RFC 9207 recommends that clients always validate the `iss` parameter when it is present. This is particularly important when: * Your application interacts with multiple authorization servers or identity providers. * You are building a multi-tenant application where each tenant may use a different issuer. * You want defense-in-depth against authorization response manipulation. Even when interacting with a single authorization server, validating the `iss` parameter is a low-cost security measure that protects against future configuration changes or attacks. Related [APIs Epic Games API Learn about the APIs for creating, retrieving, updating and disabling an Epic Games identity provider. oauth](https://fusionauth.io/docs/apis/identity-providers/epicgames.md) [APIs Facebook API Learn about the APIs for creating, retrieving, updating and disabling a Facebook identity provider. oauth](https://fusionauth.io/docs/apis/identity-providers/facebook.md) [APIs Google API Learn about the APIs for creating, retrieving, updating and disabling a Google identity provider. oauth](https://fusionauth.io/docs/apis/identity-providers/google.md) [APIs Identity Provider API Learn about the APIs for creating, retrieving, updating and deleting identity providers. oauth](https://fusionauth.io/docs/apis/identity-providers.md) --- ## Other pages in OAuth > For the full index of this section, see [Authentication](https://fusionauth.io/docs/llms-authentication.txt). - [CIMD Registration Caching And Lifecycle](https://fusionauth.io/docs/authentication/oauth/cimd-registration-lifecycle.md): Learn how long FusionAuth caches a Client ID Metadata Document, what happens when it expires, and how a CIMD client registration is refreshed or removed. - [OAuth Client Registration | Static and CIMD](https://fusionauth.io/docs/authentication/oauth/client-registration.md): Learn how FusionAuth registers OAuth clients, either ahead of time as Applications or just-in-time from a Client ID Metadata Document. - [OAuth DPoP](https://fusionauth.io/docs/authentication/oauth/dpop.md): Learn how to enable sender-constrained OAuth tokens DPoP (Demonstration of Proof-of-Possession) with FusionAuth and validate DPoP proofs in your APIs. - [Host A Client ID Metadata Document (CIMD)](https://fusionauth.io/docs/authentication/oauth/host-cimd-document.md): Publish a Client ID Metadata Document so your OAuth client can log in to FusionAuth without being registered ahead of time. - [OAuth](https://fusionauth.io/docs/authentication/oauth.md): Learn about the OAuth 2.0 and OpenID Connect grants FusionAuth supports for login and single sign-on. - [Connect claude.ai And chatgpt.com To A FusionAuth-Protected MCP Server](https://fusionauth.io/docs/authentication/oauth/mcp-clients-claude-chatgpt.md): Learn how to connect claude.ai and chatgpt.com to an MCP server protected by FusionAuth using Client ID Metadata Documents. - [Modes](https://fusionauth.io/docs/authentication/oauth/modes.md): Learn about the eight common ways apps use OAuth and OpenID Connect. - [OIDC Prompt](https://fusionauth.io/docs/authentication/oauth/prompt.md): Learn about OpenID Connect prompt and example use cases. - [OAuth Response Modes](https://fusionauth.io/docs/authentication/oauth/response-modes.md): Learn about OAuth 2.0 response modes (query, fragment, form_post) and when to use each one. - [Manage Software Tokens](https://fusionauth.io/docs/authentication/oauth/tokens.md): Learn about OAuth2 and OpenID Connect Tokens and how they are used. - [URL Validation](https://fusionauth.io/docs/authentication/oauth/url-validation.md): Learn about OAuth URL validation policies in FusionAuth.