rules:
  - id: auth.csharp.jwt.validate-issuer-disabled
    languages:
      - csharp
    severity: ERROR
    message: |
      A JWT bearer setup disables issuer validation
      (`ValidateIssuer = false`) on `TokenValidationParameters`. With the issuer
      unchecked, a token from any issuer or identity provider is accepted, so an
      attacker who controls (or spins up) any IdP can mint tokens this service
      will trust (CWE-287). This is a common AI-generated shortcut: the check is
      disabled to get past an `iss` mismatch during setup and never restored.

      Leave `ValidateIssuer` at its secure default (`true`) and pin the expected
      issuer with `ValidIssuer` (or `ValidIssuers`) so only tokens from your own
      authority are honored.
    # Matches the explicit `ValidateIssuer = false` assignment (object
    # initializer or property set). The secure default is `true`, so only an
    # explicit disable fires; no bare property read can trip it.
    patterns:
      - pattern: ValidateIssuer = false
      - pattern-inside: $A.AddJwtBearer(...)
    paths:
      exclude:
        - "**/test/**"
        - "**/*.Tests/**"
        - "**/*.Test/**"
        - "**/samples/**"
        - "**/sandbox/**"
        - "**/example/**"
        - "**/examples/**"
        - "**/demo/**"
        - "**/benchmark/**"
    metadata:
      oauthlint-rule-id: AUTH-CSHARP-JWT-004
      oauthlint-doc-url: https://oauthlint.dev/rules/csharp-jwt-validate-issuer-disabled
      category: security
      cwe: CWE-287
      owasp: API2:2023
      llm-prevalence: MEDIUM
      technology:
        - aspnetcore
        - jwt-bearer
      references:
        - https://learn.microsoft.com/aspnet/core/security/authentication/jwt-authn
        - https://cwe.mitre.org/data/definitions/287.html