mirror of
https://github.com/luxfi/aml.git
synced 2026-09-24 00:25:20 +00:00
zeekayandHanzo Dev
5690eaeb5d
golang-jwt validates `iss` only when an expectation is stated (validator.go, `if v.expectedIss != ""`), so a brand row carrying no issuer would not weaken the per-Host pin — it would delete it, and every brand's tokens would authenticate on that host. Stated expectation or no tenant. The shared-keyset fixture now says why it is the honest one: the live issuers serve the SAME set, and zoolabs.id publishes cert-lux beside cert-zoo, so a Lux token's signature does verify against Zoo's keys and the pin is the whole defence. Co-authored-by: Hanzo Dev <[email protected]>