title: How to exchange an authorization token on the server side
body: <p>I've got an ASP.Net Core 2.1 Web API, using OAuth authentication. In addition, we are using claims-based authentication, with the claims encoded in the auth token. </p>
  
  <p>This has been working well for a while, but lately things have gotten out of hand when a new requirement came up that radically multiplied the number of claims that had to be stored in the token. To cut a long story short, we're now at the point where the auth token is so long that we had to reconfigure our server to allow headers over 128k. </p>
  
  <p>This is obviously untenable; just from the perspective of network traffic it's absurd to have to send over 100k of headers along with the simplest GET request. So now I'm thinking along the following lines: instead of encoding the claims in the token, just use a Guid token and store the claims in the <em>database</em> along with the token, so when we validate the token we can pull out the claims at the same time and exchange those locally.</p>
  
  <p>Theoretically this should solve our entire problem in one fell swoop, but I'm just stuck on the implementation details, specifically: since the claim-based authentication is expecting to find the claims encoded in the auth token, how do I swap out the Guid auth token for the one that includes all the claims?</p>
  
  <p>Existing code:</p>
  
  <pre><code>public class MyAuthenticationEvents : OAuthValidationEvents
  {
      public override async Task ValidateToken(ValidateTokenContext context)
      {
          if (context.Properties.ExpiresUtc &lt; DateTime.UtcNow)
          {
              context.Fail("Access Token has expired.");
              return;
          }
          if (!await TokenIsValidAsync(context)) // code to validate the auth token against the database, could be modified to return claims
          {
              context.Fail("Access Token has not been properly set or has been invalidated.");
              return;
          }
          // Here I would expect to do some skullduggery to switch the compact Guid token for a large token containing claims
          context.Success();
      }
  }
  </code></pre>
  
  <p>What's the correct syntax? Or am I barking up the wrong tree, and there's an entirely better way of achieving my objective?</p>