EMG - JWT token validated against both API Proxies and Resource URI in OAUTH

Google Cloud Apigee
1

The inbuilt plugin for EMG OAuth validates both the APIProxies and Resource URIs in the Product against the JWT token payload product details. Why both needs to be validated (Proxy and Resource URIs)?

If I want to do only resource URI verification, not the API Proxy , is there any way I can do that?

const checkIfAuthorized = module.exports.checkIfAuthorized = function checkIfAuthorized(config, urlPath, proxy, decodedToken)

{ if (!decodedToken.api_product_list) { return false; } return decodedToken.api_product_list.some(function (product) { const validProxyNames = config.product_to_proxy[product]; if (!validProxyNames) { return false; } const apiproxies = config.product_to_api_resource[product]; var matchesProxyRules = false; if(apiproxies && apiproxies.length){

1 Like
2

This behaviour is not consistent with Edge.

@kevinswiber - this looks like a defect.

1 Like
3

Was that bug fixed in recent EMG versions?

4

No @Francois-Xavier KOWALSKI, this has not been fixed yet.

5

Internal ticket has been labeled cs critical for this bug. Awaiting update from engineering