title: JWT token validation in ASP.NET
body: <p>I'm writing an API in ASP.NET that exposes two endpoints: one to generate a JWT token and other to validate a given token.</p>
  
  <p>The token generation seems to work fine:</p>
  
  <pre><code> [HttpPost]
          public IHttpActionResult Token()
          {
              var headerAuth = HttpContext.Current.Request.Headers["Authorization"];
              if (headerAuth.ToString().StartsWith("Basic"))
              {
                  var credValue = headerAuth.ToString().Substring("Basic".Length).Trim();
                  var usernameAndPassEnc = Encoding.UTF8.GetString(Convert.FromBase64String(credValue));
                  var usernameAndPass = usernameAndPassEnc.Split(':');
  
                  LdapAuthentication ldap = new LdapAuthentication();
  
                  if (ldap.IsAuthenticated(usernameAndPass[0], usernameAndPass[1]))
                  {
                      var claimsData = new[] { new Claim(ClaimTypes.Name, usernameAndPass[0]) };
                      var key = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secret"));
                      var signInCred = new SigningCredentials(key, SecurityAlgorithms.HmacSha256Signature, SecurityAlgorithms.Sha256Digest);
                      var tokenString = new JwtSecurityToken(
                          issuer: "http://my.website.com",
                          audience: "http://my.tokenissuer.com",
                          expires: DateTime.Now.AddMinutes(1),
                          claims: claimsData,
                          signingCredentials: signInCred
                          );
  
                      var token = new JwtSecurityTokenHandler().WriteToken(tokenString);
                      return Ok(token);
                  }
              }
  
              return BadRequest("Bad request");
          }  
  </code></pre>
  
  <p>But I don't know how to validate a given token, in ASP.NET Core I implement it in this whay (which works fine):</p>
  
  <pre><code>public void ConfigureServices(IServiceCollection services)
          {
              services.AddAuthentication(JwtBearerDefaults.AuthenticationScheme).AddJwtBearer(options =&gt;
              {
                  options.TokenValidationParameters = new TokenValidationParameters
                  {
                      ValidateIssuer = true,
                      ValidateAudience = true,
                      ValidateIssuerSigningKey = true,
                      ValidIssuer = "http://my.website.com",
                      ValidAudience = "http://my.tokenissuer.com",
                      IssuerSigningKey = new SymmetricSecurityKey(Encoding.UTF8.GetBytes("secret"))
                  };
              });
              services.AddMvc();
          }
  
          // This method gets called by the runtime. Use this method to configure the HTTP request pipeline.
          public void Configure(IApplicationBuilder app, IHostingEnvironment env)
          {
              if (env.IsDevelopment())
              {
                  app.UseDeveloperExceptionPage();
              }
  
              app.UseAuthentication();
              app.UseMvc();
          }
  </code></pre>
  
  <p>So, how can I validate a JWT token in ASP.NET?</p>