asp.net web api - c#: JWT ValidateToken overriding? -

i have setup token authentication process , working quite well. using owin.

i extending 2 specific points lets me control signing of jwt , validating of user credentials so.

            provider = new myoauthprovider(),             accesstokenformat = new myjwtformatter() 

how hook part token being validated. searched google , appears there method can't validatetoken can override don't know is.

i have following. need override here ?

        app.usejwtbearerauthentication(             new jwtbearerauthenticationoptions                 {                     authenticationmode = authenticationmode.active,                     allowedaudiences = new[] { audience },                     issuersecuritytokenproviders =                         new iissuersecuritytokenprovider[]                             {                                 new symmetrickeyissuersecuritytokenprovider(                                     issuer,                                     secret)                             }                 }); 

if has clue of missing appreciate info. of things have found support doing not hooking token authentication.

i believe using internal jwttokenhandler, presume can override or something?

here's simple jwt validation class based on: google sign-in websites

using system; using system.collections.generic; using system.identitymodel.tokens; using system.linq; using system.net.http; using system.web; using system.web.configuration; using newtonsoft.json; using system.net; using system.threading.tasks; using system.threading; using services.models; using system.security.claims;  namespace services {     /// <summary>     ///  implementation of google jwt verification     ///  demonstrates:     ///    - jwt validation     /// </summary>     /// @author kunal.bajpai@gmail.com (kunal bajpai)       public class customjwthandler : delegatinghandler     {         string issuer = webconfigurationmanager.appsettings["googledomain"];         string audience = webconfigurationmanager.appsettings["googleclientid"];          /// <summary>         ///          /// </summary>         /// <param name="request"></param>         /// <param name="cancellationtoken"></param>         /// <returns></returns>         protected override task<httpresponsemessage> sendasync(httprequestmessage request, cancellationtoken cancellationtoken)         {             httpstatuscode statuscode;             string token;              var authheader = request.headers.authorization;             if (authheader == null)             {                 // missing authorization header                 return base.sendasync(request, cancellationtoken);             }              if (!tryretrievetoken(request, out token))             {                 return task<httpresponsemessage>.factory.startnew(() => new httpresponsemessage(httpstatuscode.unauthorized));             }              try             {                 validatetoken(token);                 return base.sendasync(request, cancellationtoken);             }             catch (securitytokeninvalidaudienceexception)             {                 statuscode = httpstatuscode.unauthorized;             }             catch (securitytokenvalidationexception)             {                 statuscode = httpstatuscode.unauthorized;             }             catch (exception e)             {                 statuscode = httpstatuscode.internalservererror;             }              return task<httpresponsemessage>.factory.startnew(() => new httpresponsemessage(statuscode));         }         /// <summary>         /// validates jwt token         /// </summary>         /// <param name="token"></param>         private void validatetoken(string token)         {             try             {                 using (webclient wc = new webclient())                 {                     tokeninfo tokeninfo = jsonconvert.deserializeobject<tokeninfo>(wc.downloadstring("https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=" + token));                      list<claim> claims = new list<claim> {                         new claim(claimtypes.name, tokeninfo.name),                         new claim(claimtypes.email, tokeninfo.email),                         new claim(claimtypes.givenname, tokeninfo.givenname),                         new claim(claimtypes.surname, tokeninfo.familyname),                     };                      claimsprincipal claimsprincipal = new claimsprincipal(new claimsidentity(claims, tokeninfo.issuer));                     thread.currentprincipal = claimsprincipal;                     httpcontext.current.user = claimsprincipal;                 }             }             catch (webexception e)             {                 httpstatuscode statuscode = ((httpwebresponse)e.response).statuscode;                 if (statuscode == httpstatuscode.badrequest)                 {                     throw new securitytokenvalidationexception();                 }                 else                 {                     throw new exception();                 }             }         }         /// <summary>         /// tries retrieve token         /// </summary>         /// <param name="request"></param>         /// <param name="token"></param>         /// <returns></returns>         private static bool tryretrievetoken(httprequestmessage request, out string token)         {             token = null;             ienumerable<string> authorizationheaders;              if (!request.headers.trygetvalues("authorization", out authorizationheaders) ||             authorizationheaders.count() > 1)             {                 return false;             }              var bearertoken = authorizationheaders.elementat(0);             token = bearertoken.startswith("bearer ") ? bearertoken.substring(7) : bearertoken;             return true;         }     } }