Changes to the scope of an API endpoint are not taken into account unless restarting WSO2. Product bug? If not, any way to configure this behaviour?

Question

Starting with an API defined in WSO2 with no scopes associated to its endpoints...

... I get an access token and invoke them correctly.

Now I modify and publish my API, assigning a scope to one on the endpoints so that it requires the editor scope:

Now I invoke that editor scoped endpoint with the previous access_token and it works. This shouldn't happen since the token was given with the default scope, not the editor one.

Now I restart WSO2 and try again with the same token, getting the expected result of access denied:

(900910) - The access token does not allow you to access the requested resource</ams:description></ams:fault>% 

I have needed to restart the platform so that scope changes are considered!! Is this a bug, a expected behaviour (it shouldn't...) of is there any way to force the refreshment of the endpoint requirements (appart from just publishing the changed API).?

Answer 1

If you generate a new access token after either modifying or deleting a scope of an API resource that you had previously invoked, you will not be able to access that particular resource of the API for a period of 15 minutes, which is the default Gateway cache period, because the WSO2 API Manager Gateway is designed to cache the details of the resource on its side.

Ref: https://docs.wso2.com/display/AM250/Scope+Management+with+OAuth+Scopes

This is not a practical problem in a typical production environment, as API updates in a production environment are very rare.

However, if this is really a problem for you, you can override the default scope validator[1] by extending it to not to use this cache. This is configured in identity.xml.

[1] https://github.com/wso2-extensions/identity-inbound-auth-oauth/blob/master/components/org.wso2.carbon.identity.oauth/src/main/java/org/wso2/carbon/identity/oauth2/validators/JDBCScopeValidator.java#L92