RFC 9207 iss parameter not advertised in OAuth metadata

What it means

RFC 9207 defines an iss parameter that the authorization server sends back on every authorization response. It names the authorization server that signed the response. A client that validates it catches mix-up attacks between two authorization servers configured for the same resource. MCP clients must validate this parameter per RFC 9207 Section 2.4, but only when the authorization server advertises support. The signal is authorization_response_iss_parameter_supported: true in the metadata. Without the flag a client has no reason to look for the parameter and the mitigation is off. The MCP spec marks this as SHOULD today and says a future revision will raise it to MUST. The check is low severity for now and will likely rise.

How to fix

Set "authorization_response_iss_parameter_supported": true in /.well-known/oauth-authorization-server. Include the iss parameter in every authorization response, including error responses.

Spec