Module: Hitch::IssuerUrl

Extended by:

ActiveSupport::Concern

Included in:

ApplicationController, AuthorizationRequest, PublicEndpointController

Defined in:

app/controllers/concerns/hitch/issuer_url.rb

Overview

The authorization server's issuer identifier (RFC 8414 §2).

Shared because it MUST be byte-identical everywhere it appears. The discovery document advertises it as issuer; the authorization response carries it as iss (RFC 9207); bearer challenges point back to it. Clients compare these values exactly.

The issuer is the fixed origin of the canonical resource_uri. It never comes from Host or Forwarded headers. allowed_hosts are ingress aliases, not alternate issuer identities; every accepted alias advertises this same canonical origin.