anguillanneuf: @busunkim96 How to increase coverage in `jwt.py` line 294-5 and 296-7? 

```
.nox/cover/lib/python3.7/site-packages/google/auth/jwt.py                            209      2     46      2    98%   294->295, 295, 296->297, 297
Command coverage report --show-missing --fail-under=100 failed with exit code 2
Session cover failed.
```
anguillanneuf: @busunkim96 Oh I just saw you opened a similar PR here too. 
diff --git a/google/auth/transport/requests.py b/google/auth/transport/requests.py
index 9f55bea..4f5af7d 100644
--- a/google/auth/transport/requests.py
+++ b/google/auth/transport/requests.py
@@ -365,7 +365,11 @@ class AuthorizedSession(requests.Session):
             six.raise_from(new_exc, caught_exc)
 
         try:
-            self._is_mtls, cert, key = google.auth.transport._mtls_helper.get_client_cert_and_key(
+            (
+                self._is_mtls,
+                cert,
+                key,
+            ) = google.auth.transport._mtls_helper.get_client_cert_and_key(
                 client_cert_callback
             )
 
diff --git a/google/oauth2/id_token.py b/google/oauth2/id_token.py
index e78add4..bf6bf2c 100644
--- a/google/oauth2/id_token.py
+++ b/google/oauth2/id_token.py
@@ -80,6 +80,8 @@ _GOOGLE_APIS_CERTS_URL = (
     "/securetoken@system.gserviceaccount.com"
 )
 
+_GOOGLE_ISSUERS = ["accounts.google.com", "https://accounts.google.com"]
+
 
 def _fetch_certs(request, certs_url):
     """Fetches certificates.
@@ -140,11 +142,23 @@ def verify_oauth2_token(id_token, request, audience=None):
 
     Returns:
         Mapping[str, Any]: The decoded token.
+
+    Raises:
+        exceptions.GoogleAuthError: If the issuer is invalid.
     """
-    return verify_token(
+    idinfo = verify_token(
         id_token, request, audience=audience, certs_url=_GOOGLE_OAUTH2_CERTS_URL
     )
 
+    if idinfo["iss"] not in _GOOGLE_ISSUERS:
+        raise exceptions.GoogleAuthError(
+            "Wrong issuer. 'iss' should be one of the following: {}".format(
+                _GOOGLE_ISSUERS
+            )
+        )
+
+    return idinfo
+
 
 def verify_firebase_token(id_token, request, audience=None):
     """Verifies an ID Token issued by Firebase Authentication.

Make `verify_oauth2_token` check the issuer claim
It [doesn't](https://github.com/googleapis/google-auth-library-python/search?q=%22accounts.google.com%22&unscoped_q=%22accounts.google.com%22) look like the Python library checks for the issuer claim as it does for other language libraries ([Node.js](https://github.com/googleapis/google-auth-library-nodejs/blob/07955406e85f07fb60821192253205b9f4137ab9/src/auth/oauth2client.ts#L513-L516)).

It would make the Google authentication instructions [here](https://developers.devsite.corp.google.com/identity/sign-in/web/backend-auth#using-a-google-api-client-library) more consistent across if `verify_oauth2_token` checks both "`accounts.google.com`" and "`https://accounts.google.com`".

diff --git a/tests/oauth2/test_id_token.py b/tests/oauth2/test_id_token.py
index ff85807..0c70d68 100644
--- a/tests/oauth2/test_id_token.py
+++ b/tests/oauth2/test_id_token.py
@@ -95,6 +95,7 @@ def test_verify_token_args(_fetch_certs, decode):
 
 @mock.patch("google.oauth2.id_token.verify_token", autospec=True)
 def test_verify_oauth2_token(verify_token):
+    verify_token.return_value = {"iss": "accounts.google.com"}
     result = id_token.verify_oauth2_token(
         mock.sentinel.token, mock.sentinel.request, audience=mock.sentinel.audience
     )
@@ -108,6 +109,16 @@ def test_verify_oauth2_token(verify_token):
     )
 
 
+@mock.patch("google.oauth2.id_token.verify_token", autospec=True)
+def test_verify_oauth2_token_invalid_iss(verify_token):
+    verify_token.return_value = {"iss": "invalid_issuer"}
+
+    with pytest.raises(exceptions.GoogleAuthError):
+        id_token.verify_oauth2_token(
+            mock.sentinel.token, mock.sentinel.request, audience=mock.sentinel.audience
+        )
+
+
 @mock.patch("google.oauth2.id_token.verify_token", autospec=True)
 def test_verify_firebase_token(verify_token):
     result = id_token.verify_firebase_token(

pip install -e .[dev]
parse_log_pytest
requirements.txt
pytest pytest-cov pytest-localserver responses grpcio cryptography mock
3.9
requirements/base.txt
pytest --no-header -rA --tb=line --color=no -p no:cacheprovider -W ignore::DeprecationWarning
cachetools==4.2.4
certifi==2025.1.31
cffi==1.17.1
charset-normalizer==3.4.1
coverage==7.8.0
cryptography==44.0.2
exceptiongroup==1.2.2
-e git+https://github.com/googleapis/google-auth-library-python.git@06d7f97adaebb3b34ce6a159c23061dd2554e8ac#egg=google_auth
grpcio==1.71.0
idna==3.10
iniconfig==2.1.0
MarkupSafe==3.0.2
mock==5.2.0
packaging==24.2
pluggy==1.5.0
pyasn1==0.6.1
pyasn1_modules==0.4.2
pycparser==2.22
pytest==8.3.5
pytest-cov==6.0.0
pytest-localserver==0.9.0.post0
PyYAML==6.0.2
requests==2.32.3
responses==0.25.7
rsa==4.9
six==1.17.0
tomli==2.2.1
urllib3==2.3.0
Werkzeug==3.1.3

name: google-auth-library-python
channels:
  - defaults
  - https://repo.anaconda.com/pkgs/main
  - https://repo.anaconda.com/pkgs/r
  - conda-forge
dependencies:
  - _libgcc_mutex=0.1=main
  - _openmp_mutex=5.1=1_gnu
  - ca-certificates=2025.2.25=h06a4308_0
  - ld_impl_linux-64=2.40=h12ee557_0
  - libffi=3.4.4=h6a678d5_1
  - libgcc-ng=11.2.0=h1234567_1
  - libgomp=11.2.0=h1234567_1
  - libstdcxx-ng=11.2.0=h1234567_1
  - ncurses=6.4=h6a678d5_0
  - openssl=3.0.16=h5eee18b_0
  - pip=25.0=py39h06a4308_0
  - python=3.9.21=he870216_1
  - readline=8.2=h5eee18b_0
  - setuptools=75.8.0=py39h06a4308_0
  - sqlite=3.45.3=h5eee18b_0
  - tk=8.6.14=h39e8969_0
  - tzdata=2025a=h04d1e81_0
  - wheel=0.45.1=py39h06a4308_0
  - xz=5.6.4=h5eee18b_1
  - zlib=1.2.13=h5eee18b_1
  - pip:
      - cachetools==4.2.4
      - certifi==2025.1.31
      - cffi==1.17.1
      - charset-normalizer==3.4.1
      - coverage==7.8.0
      - cryptography==44.0.2
      - exceptiongroup==1.2.2
      - grpcio==1.71.0
      - idna==3.10
      - iniconfig==2.1.0
      - markupsafe==3.0.2
      - mock==5.2.0
      - packaging==24.2
      - pluggy==1.5.0
      - pyasn1==0.6.1
      - pyasn1-modules==0.4.2
      - pycparser==2.22
      - pytest==8.3.5
      - pytest-cov==6.0.0
      - pytest-localserver==0.9.0.post0
      - pyyaml==6.0.2
      - requests==2.32.3
      - responses==0.25.7
      - rsa==4.9
      - six==1.17.0
      - tomli==2.2.1
      - urllib3==2.3.0
      - werkzeug==3.1.3
prefix: /opt/conda/envs/google-auth-library-python

tests/oauth2/test_id_token.py::test_verify_oauth2_token_invalid_iss
tests/oauth2/test_id_token.py::test_fetch_id_token_from_explicit_cred_json_file
tests/oauth2/test_id_token.py::test__fetch_certs_success tests/oauth2/test_id_token.py::test__fetch_certs_failure tests/oauth2/test_id_token.py::test_verify_token tests/oauth2/test_id_token.py::test_verify_token_args tests/oauth2/test_id_token.py::test_verify_oauth2_token tests/oauth2/test_id_token.py::test_verify_firebase_token tests/oauth2/test_id_token.py::test_fetch_id_token_from_metadata_server tests/oauth2/test_id_token.py::test_fetch_id_token_no_cred_json_file tests/oauth2/test_id_token.py::test_fetch_id_token_invalid_cred_file
google/oauth2/id_token.py google/auth/transport/requests.py
google/oauth2/id_token.py google/auth/transport/requests.py