<p>From this page: <a href="https://www.pingidentity.com/en/company/blog/posts/2019/jwt-security-nobody-talks-about.html" rel="noreferrer">https://www.pingidentity.com/en/company/blog/posts/2019/jwt-security-nobody-talks-about.html</a>:</p>
<blockquote>
<p>The fourth security-relevant reserved claim is &quot;iss.&quot; This claim indicates the identity &gt; of the party that issued the JWT. The claim holds a simple string, of which the value is &gt; at the discretion of the issuer. The consumer of a JWT should always check that the &gt; &quot;iss&quot; claim matches the expected issuer (e.g., sso.example.com).</p>
</blockquote>
<p>As an example, in Kubernetes when I configure the kubernetes auth like this for using a JWT for a vault service account (from helm), I no longer get an ISS error when accessing the vault:</p>
<pre class="lang-sh prettyprint-override"><code>vault write auth/kubernetes/config \
      token_reviewer_jwt=&quot;$(cat /var/run/secrets/kubernetes.io/serviceaccount/token)&quot; \
      kubernetes_host=&quot;https://$KUBERNETES_PORT_443_TCP_ADDR:443&quot; \
      kubernetes_ca_cert=@/var/run/secrets/kubernetes.io/serviceaccount/ca.crt \
      issuer=&quot;https://kubernetes.default.svc.cluster.local&quot;
</code></pre>
<p>But what does this URL mean? Is it a somewhat arbitrary string that was set when the JWT was generated?</p>

<p><em>JWT token issuer</em> - is the <strong>party</strong> that &quot;created&quot; the token and signed it with its private key.</p>
<p>Anyone can create tokens, make sure that the tokens you receive is created by a party that you trust.</p>
