From 20e644748a09c6dba415dc52a8f8875870956521 Mon Sep 17 00:00:00 2001 From: Cursor Agent Date: Thu, 21 May 2026 19:51:03 +0000 Subject: [PATCH] fix(jwt): make _get_decode_options explicitly control verify_iss Previously, _get_decode_options only set verify_aud based on whether audience was provided. The issuer JWT path relied on always passing issuer=issuer_config.issuer to trigger PyJWT's default verify_iss=True, making the helper's behavior implicitly dependent on caller behavior. Now _get_decode_options accepts issuer as well, mirroring the verify_aud handling and matching the dimensions handled by _build_decode_kwargs. Co-authored-by: Yassin Kortam --- litellm/proxy/auth/handle_jwt.py | 13 +++++++++---- 1 file changed, 9 insertions(+), 4 deletions(-) diff --git a/litellm/proxy/auth/handle_jwt.py b/litellm/proxy/auth/handle_jwt.py index 582acab68d8..1409e61e339 100644 --- a/litellm/proxy/auth/handle_jwt.py +++ b/litellm/proxy/auth/handle_jwt.py @@ -968,11 +968,16 @@ class JWTHandler: return jwk def _get_decode_options( - self, audience: Optional[Union[str, List[str]]] + self, + audience: Optional[Union[str, List[str]]], + issuer: Optional[str] = None, ) -> Optional[dict]: + options: dict = {} if audience is None: - return {"verify_aud": False} - return None + options["verify_aud"] = False + if issuer is None: + options["verify_iss"] = False + return options or None def _decode_jwt_with_public_key( self, @@ -985,7 +990,7 @@ class JWTHandler: decode_options = ( options if options is not None - else self._get_decode_options(audience=audience) + else self._get_decode_options(audience=audience, issuer=issuer) ) if isinstance(public_key, dict):