为什么未订阅的应用程序令牌可以用于访问 WSO2 APIM 端点？

Question

There is an API hosted in WSO2 APIM 4.1.0 and there are two different App subscribed to that API.

Before Unsubscribe:

I just unsubscribed one of App to delete the API subscription by follows wso2 doc

After Unsubscribe:

After unsubscribed , I can able to invoke WSO2 API by using unsubscribed Application token

It should now allow that unsubscribed app to invoke API. OR correct me if my understanding is wrong.

Postman:

Note: In above API Hit, I passed unsubscribed APP token as Authorization

Answer 1

In your case, you should not be able to invoke the API without a proper subscriptions. Although the token is valid, you should get a 403 HTTP code saying subscription validation has failed.

You can check whether the events are propagated successfully to your gateway node from the control plane node. This is basically when you have a distributed setup. If you have a HA setup, verify both nodes are working properly when it comes to event distribution.

Answer 2

Are you using the GA release of APIM 4.1.0? If so, this could be a bug in that was fixed later through U2 updates. When an application subscription is deleted, any API invocations done using the tokens of that application should fail due subscription validation with an error similar to the one below with a 403 HTTP code.

{"code":"900908","message":"Resource forbidden ","description":"User is NOT authorized to access the Resource. API Subscription validation failed."}

If you have a paid WSO2 subsciption, please try this scenario by taking the latest U2 updated/patched version of APIM 4.1.0 by referring this .

Answer 3

I tried the GA APIM 4.1.0 and this usecase worked as expected. Shall we verify the subscription delete event flow in the API gateway by enabling debug logs for gateway and keymanagement components?

Add the following configurations in the <APIM_HOME>/repository/logs/log4j2.properties

logger.gateway-component.name = org.wso2.carbon.apimgt.gateway
logger.gateway-component.level = DEBUG

logger.keymgt-component.name = org.wso2.carbon.apimgt.keymgt
logger.keymgt-component.level = DEBUG

make sure to add the newly created loggers as below.

loggers =  gateway-component,keymgt-component, AUDIT_LOG, trace-messages, org-apache-coyote, ....

With these, subscribe and unsubscribe events should be displayed in the terminal. You can use them to verify the event flow.