title: Correct use of JwtTokens in C#
body: <p>I'm playing a with JwtTokens and can't make them work properly.
  I'm using <a href="http://www.nuget.org/packages/System.IdentityModel.Tokens.Jwt/" rel="noreferrer">http://www.nuget.org/packages/System.IdentityModel.Tokens.Jwt/</a> for it.
  I know the code is a mess but is just to show what I'm trying to do.
  The problem is that I want the JwtTokenHandler to fail the validation because of the lifetime.</p>
  
  <pre><code>var key = "5A0AB091-3F84-4EC4-B227-0834FCD8B1B4";
  var domain = "http://localhost";
  var allowedAudience = "http://localhost";
  var signatureAlgorithm = "http://www.w3.org/2001/04/xmldsig-more#hmac-sha256";
  var digestAlgorithm = "http://www.w3.org/2001/04/xmlenc#sha256";
  var issuer = "self";
  var securityKey = System.Text.Encoding.Unicode.GetBytes(key);
  var inMemorySymmetricSecurityKey = new InMemorySymmetricSecurityKey(securityKey);
  
  var now = DateTime.UtcNow;
  var expiry = now.AddSeconds(1);
  var tokenHandler = new JwtSecurityTokenHandler();
  var claimsList = new List&lt;Claim&gt;()
  {
      new Claim(ClaimTypes.Name, "user"),
      new Claim(ClaimTypes.Webpage, allowedAudience),
      new Claim(ClaimTypes.Uri, domain),                
      new Claim(ClaimTypes.Expiration,expiry.Ticks.ToString())
  };
  var roles = new List&lt;string&gt;() { "admin" };
  claimsList.AddRange(roles.Select(role =&gt; new Claim(ClaimTypes.Role, role)));
  
  var identity = new GenericIdentity("user");
  
  var tokenDescriptor = new SecurityTokenDescriptor
  {
      Subject = new ClaimsIdentity(identity, claimsList),
      TokenIssuerName = issuer,
      AppliesToAddress = allowedAudience,
      Lifetime = new Lifetime(now, expiry),
      SigningCredentials = new SigningCredentials(inMemorySymmetricSecurityKey, signatureAlgorithm, digestAlgorithm),
  };
  
  var token = tokenHandler.WriteToken(tokenHandler.CreateToken(tokenDescriptor));
  
  var validationParameters = new TokenValidationParameters()
  {
      ValidIssuer = issuer,
      ValidAudience = allowedAudience,
      IssuerSigningToken = new BinarySecretSecurityToken(securityKey)
  };
  
  Thread.Sleep(2000);
  try
  {
      SecurityToken securityToken;
      tokenHandler.ValidateToken(token, validationParameters, out securityToken);
      Console.WriteLine("OK");
  }
  catch (Exception e)
  {
      Console.WriteLine("Error {0}", e.Message);
  }
  </code></pre>
  
  <p>Isn't this suppose to fail since I'm waiting 2 seconds?
  It fails if I change the issuer of the ValidationTokenParameter to "x"...</p>