title: Validating B2C JWT tokens in Asp.Net Core Web Api
body: <p>I am using B2C to protect a WebApi in Asp.Net Core.  My code is below.   Do I need to validate the tokens or is the middleware doing it for me?  I would think if everyone had to do this, it'd be easier for me to find some sample code, but I can't seem to get any real direction on this.</p>
  
  <p>Yet, this <a href="https://docs.microsoft.com/en-us/azure/active-directory-b2c/active-directory-b2c-reference-tokens" rel="noreferrer">B2C documentation</a> states that my api do the validation.</p>
  
  <p>I found a <a href="https://github.com/Azure-Samples/active-directory-dotnet-webapi-manual-jwt-validation/blob/master/TodoListService-ManualJwt/Global.asax.cs" rel="noreferrer">sample</a> but it's not for Core and they're using <code>CertificateValidator = X509CertificateValidator.None</code>.  Doesn't that defeat the purpose?  And another <a href="https://shellmonger.com/2017/03/02/azure-app-service-authentication-in-an-asp-net-core-application/" rel="noreferrer">sample here</a> where they <strong>are</strong> doing it.</p>
  
  <p>Don't I have to have the signing key from B2C and all that?</p>
  
  <p>I can cobble together a solution from those, but do I actually need to do this?</p>
  
  <p>Thanks in advance.</p>
  
  <pre><code>        app.UseJwtBearerAuthentication(new JwtBearerOptions()
          {
              AuthenticationScheme = Constants.B2CAuthenticationSchemeName,
              AutomaticAuthenticate = false,
              MetadataAddress = string.Format(
                  _identityConfig.B2CInfo.AadInstance,
                  _identityConfig.B2CInfo.Tenant,
                  _identityConfig.B2CInfo.Policies
                      .Where(p =&gt; p.IsDefaultSignUpSignInPolicy == true)
                      .First()
                      .Name),
              Audience = _identityConfig.B2CInfo.ClientId,
              TokenValidationParameters = new TokenValidationParameters
              {
                  ValidateLifetime = true,
                  RequireExpirationTime = true,
                  RequireSignedTokens = true,
              },
              Events = new JwtBearerEvents
              {
                  OnAuthenticationFailed = B2CAuthenticationFailed
              }
          });
  </code></pre>