e token issuer is not in
<code>RequestAuthentication</code> will bypass the JWT validation, instead of getting rejected.</p><h2 id=mitigation>Mitigation</h2><p>For proper JWT validation, you should always use the <code>AuthorizationPolicy</code> as documented on istio.io for
<a href=/v1.11/docs/tasks/security/authentication/authn-policy/#require-a-valid-token>specifying a valid token</a>.
To do this you will have to audit all of your <code>RequestAuthentication</code> and subsequent <code>AuthorizationPolic