title: Validating issuer fails when site is reached under different alias as configured in the jwt bearer handler
body: <p>I have web api which uses jwt bearer authentication. The implementation (<a href="https://github.com/openiddict/openiddict-core" rel="nofollow noreferrer">openiddict</a>) which creates the jwt uses the the current url as issuer.</p>
  <pre><code>services
      .AddOpenIddict()
      .UseJsonWebTokens();
  </code></pre>
  <p>I configured the jwt authentication handler to use a valid issuer.</p>
  <pre><code>services
      .AddAuthentication()
      .AddJwtBearer(options =&gt;
      {
          options.Authority = &quot;http://test/&quot;;
          ...
      });
  </code></pre>
  <p>When I reach the site under <code>http://test/</code> I get an access token with the issuer set to <code>http://test/</code>. As the <code>Authority</code> matches the issuer the requests will be authenticated.</p>
  <p>When I reach the site under <code>http://125.124.35.21/</code> I get an access token with the issuer set to <code>http://125.124.35.21/</code>. As the <code>Authority</code> doesn't match the issuer the request won't be authenticated.</p>
  <blockquote>
  <p>I want in both cases to be able to authenticate the request.</p>
  </blockquote>
  <p>Now I saw that according to <a href="https://www.rfc-editor.org/rfc/rfc7519#section-4.1.1" rel="nofollow noreferrer">the jwt rfc</a> the <code>iss</code> claim is optional.</p>
  <p>My question is if I can set <code>ValidateIssuer</code> to false for this purpose, if I open a security hole when I do that and if there is an more recommended alternative?</p>
  <pre><code>services
      .AddAuthentication()
      .AddJwtBearer(options =&gt;
      {
          options.Authority = &quot;http://test/&quot;;
          options.TokenValidationParameters = new TokenValidationParameters
          {
              ValidateIssuer = false,
              ...
          }
      });
  </code></pre>
  <p>Which configuration is used to resolve the <code>.well-known/openid-configuration</code>?The <code>Authority</code>? Hopefully not the issuer because that would mean that everybody can issue a token and use it with my api.</p>