title: Retrieve bearer token from header and/or query string in ASP.NET WebAPI 2
body: <h3>Background:</h3>
  <p>I have an ASP.NET WebAPI project. I'm using Bearer Tokens to authenticate my users. Some of my controller actions are marked with <code>[Authorized]</code> filter. In the client side, the client gets his token by invoking <code>http://foo.bar/Token</code> and then adding that token as an <code>Authorization</code> header to its requests.</p>
  <p>There is no problem up to this point and everything is working as it should with these settings in my <code>Startup.Auth.cs</code> class:</p>
  <pre class="lang-cs prettyprint-override"><code>OAuthOptions = new OAuthAuthorizationServerOptions
  {
      TokenEndpointPath = new PathString(&quot;/Token&quot;),
      Provider = new ApplicationOAuthProvider(PublicClientId),
      AuthorizeEndpointPath = new PathString(&quot;/api/Account/ExternalLogin&quot;),
      AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
      // In production mode set AllowInsecureHttp = false
      AllowInsecureHttp = true                
  };
  
  // Enable the application to use bearer tokens to authenticate users
  app.UseOAuthBearerTokens(OAuthOptions);
  </code></pre>
  <p>Now I have added some SignalR Hubs to my project and I'd like to authenticate the users in the hubs as well. There are some other questions that deal with how to clients can add bearer token to SignalR connection. Summary:</p>
  <ul>
  <li>One way would be <a href="https://stackoverflow.com/a/26556346/4582649">adding it as an ajax default header</a> which is discouraged due to the fact that <a href="https://stackoverflow.com/a/26538699">the JS WebSocket API does not make it possible to set custom headers.</a>. So you fallback to using &quot;Long Polling&quot;. (Not what i want)</li>
  <li>Another way is <a href="https://stackoverflow.com/a/20615950">creating a custom <code>OAuth Provider</code> and passing the token as query string</a>. This approach is also discouraged because <a href="https://stackoverflow.com/a/2629241">it can become a security issue</a>. But I'd still want to use this method because I don't want Long Polling.</li>
  </ul>
  <h3>What I Tried:</h3>
  <p>So I created this class to retrieve my access token from query string.</p>
  <pre class="lang-cs prettyprint-override"><code>public class QueryStringOAuthBearerProvider : OAuthBearerAuthenticationProvider
  {
      public override Task RequestToken(OAuthRequestTokenContext context)
      {
          var value = context.Request.Query.Get(&quot;access_token&quot;);
  
          if (!string.IsNullOrEmpty(value))
          {
              context.Token = value;
          }
  
          return Task.FromResult&lt;object&gt;(null);
      }
  }
  </code></pre>
  <p>And then on the client-side, I do this to pass my access token:</p>
  <pre class="lang-js prettyprint-override"><code>var connection = $.hubConnection();
  var hub = connection.createHubProxy('fooHub');
  connection.qs = { 'access_token': myAccessToken};
  // Init connection
  </code></pre>
  <p>This is the idea but the problem arises when I want to register my <code>QueryStringOAuthBearerProvider</code> in the <code>Startup.Auth.cs</code> class.</p>
  <p>Here is how I changed my Startup.Auth.cs class:</p>
  <pre class="lang-cs prettyprint-override"><code>OAuthOptions = new OAuthAuthorizationServerOptions
  {
      TokenEndpointPath = new PathString(&quot;/Token&quot;),
      Provider = new ApplicationOAuthProvider(PublicClientId),
      AuthorizeEndpointPath = new PathString(&quot;/api/Account/ExternalLogin&quot;),
      AccessTokenExpireTimeSpan = TimeSpan.FromDays(14),
      // In production mode set AllowInsecureHttp = false
      AllowInsecureHttp = true                
  };
  
  // Enable the application to use bearer tokens to authenticate users
  app.UseOAuthBearerTokens(OAuthOptions);
  
  // Enable the application to retrieve tokens from query string to authenticate users
  app.UseOAuthBearerAuthentication(new OAuthBearerAuthenticationOptions()
  {
      Provider = new QueryStringOAuthBearerProvider()
  });
  </code></pre>
  <p>So I thought right now I can use:</p>
  <ol>
  <li>The default bearer tokens which are in the header of the requests for my WebAPI calls.</li>
  <li>The custom access tokens which are in the query string for my SignalR Hubs.</li>
  </ol>
  <h3>Results:</h3>
  <p>When I'm connecting to my hubs I can retrieve access token from query string and users are authenticated. But when I try to invoke a WebAPI controller action I get <code>System.InvalidOperationException</code> saying <code>Sequence contains more than one element</code>. I think it's because I'm registering two ways to authenticate my users through bearer tokens and OWIN doesn't like that.</p>
  <h3>Question:</h3>
  <p>How can I have both methods to get the bearer token?</p>
  <ul>
  <li>Default behaviour (Authorization Header) for WebApi calls</li>
  <li><code>QueryStringOAuthBearerProvider</code> (Query string) for SignalR Hubs.</li>
  </ul>
  <p>Please note that I don't want to pass access tokens as query string to my WebApi actions, but only to SignalR Hubs.</p>