Generate Access Token In Web Api action method usi

Question

I'm trying to generate a token inside Web Api action method based on the code below:

private JObject GeneratePaymentTokenResponse(string email, bool rememberMe)
    {
        //var tokenExpiration = rememberMe ? TimeSpan.FromDays(14) : TimeSpan.FromMinutes(30);

        var tokenExpiration = rememberMe ? TimeSpan.FromMinutes(30) : TimeSpan.FromMinutes(5);

        ClaimsIdentity identity = new ClaimsIdentity("CustomType", ClaimTypes.Email, ClaimTypes.Role);

        identity.AddClaim(new Claim(ClaimTypes.Email, email));

        var props = new AuthenticationProperties()
        {
            IssuedUtc = DateTime.UtcNow,
            ExpiresUtc = DateTime.UtcNow.Add(tokenExpiration)
        };

        var ticket = new AuthenticationTicket(identity, props);

        var accessToken = Startup.OAuthBearerOptions.AccessTokenFormat.Protect(ticket);

        JObject tokenResponse = new JObject(
                                    new JProperty("email", email),
                                    new JProperty("customToken", accessToken),
                                    new JProperty("expiresIn", tokenExpiration.TotalSeconds),
                                    new JProperty("issuedUtc", ticket.Properties.IssuedUtc),
                                    new JProperty("expiresUtc", ticket.Properties.ExpiresUtc)
    );

        return tokenResponse;
    }

The OAuthBeaerOptions object is coming from the Startup class as the below:

public static OAuthBearerAuthenticationOptions OAuthBearerOptions { get; private set; }

OAuthBearerOptions = new OAuthBearerAuthenticationOptions();
// Token Consumption (Resource Server)
app.UseOAuthBearerAuthentication(OAuthBearerOptions);

Now when I try to pass a valid access token but has been expired and call AccessTokenFormat.Unprotect as the code below

 Microsoft.Owin.Security.AuthenticationTicket ticket = Startup.OAuthBearerOptions.AccessTokenFormat.Unprotect(paymentToken);

        if ((ticket == null) || (!ticket.Identity.IsAuthenticated))
        {
            actionContext.Response = CreateForbiddenResponse(actionContext);
            return Task.FromResult<object>(null);
        }

I'm receiving a valid ticket and the value of ticket.Identity.IsAuthenticated is true even that token is expired.

Currently I'm using the latest version (3.0.1) of Microsoft.Owin.Security assembly

I would appreciate any clue on how to set the expiry date for this token?

Answer 1

I'm receiving a valid ticket and the value of ticket.Identity.IsAuthenticated is true even that token is expired.

That's totally intended: Unprotect will return a ticket with a valid ClaimsIdentity even if it is expired. Since ClaimsIdentity.IsAuthenticated only ensures the ClaimsIdentity.AuthenticationType property is not null, it's not a reliable way to ensure the ticket is not expired.

Actually, it's up to you to determine whether the ticket is still valid and return an error if necessary (which is exactly what the bearer middleware does internally when receiving an access token: https://github.com/jchannon/katanaproject/blob/master/src/Microsoft.Owin.Security.OAuth/OAuthBearerAuthenticationHandler.cs#L68-L73)

if (ticket.Properties.ExpiresUtc.HasValue &&
    ticket.Properties.ExpiresUtc.Value < DateTimeOffset.Now)
{
    return Task.FromResult<object>(null);
}