no need to verify issuer (GoogleCloudPlatform#4294)

anguillanneuf · web-flow · commit f6a29817849d · 2020-07-14T09:37:12.000-07:00
diff --git a/appengine/standard_python3/pubsub/main.py b/appengine/standard_python3/pubsub/main.py
@@ -85,12 +85,6 @@ def receive_messages_handler():
         # case they would all share the same token for a limited time window.
         claim = id_token.verify_oauth2_token(token, requests.Request(),
                                              audience='example.com')
-        # Must also verify the `iss` claim.
-        if claim['iss'] not in [
-            'accounts.google.com',
-            'https://accounts.google.com'
-        ]:
-            raise ValueError('Wrong issuer.')
         CLAIMS.append(claim)
     except Exception as e:
         return 'Invalid token: {}\n'.format(e), 400
