I've implemented Mulesoft's OAuth external provider in CH and configured APIs to use an OAuth policy using the provider. However, it only calls the provider's validate endpoint once so when an access token is revoked, the APIs still allow access using the revoked access token until the original expiration (ttl).
I'm trying to achieve a single use access token so I've added a revoke method in the provider's validate flow. So the initial validation call succeeds but any subsequent validation calls fail because the token has been revoked. However, the API Gateway OAuth policy seems to only make the initial validation call but all subsequent API calls succeed. Is the access token getting cached somewhere?
@max_ica yes, this seems to be a bug fro Mulesoft and a serious security violation.
The main culprit seems to be `OAuth 2.0 access token enforcement using external provider` policy of Mule which you applied on your proxy to validate the `access_token` against your validate url of Oauth provider
The Mule policy uses `<oauth2-gw:validate/>` component in their policy code which validates the access_token` against your validate url .
But it seems to be caching the validation result somewhere and allowing the backend API to be hit which is a serious security violation.
If you have a Mule EE licence, please raise this issue to them and also you can raise a bugs here against it
