{"action":"opened","issue":{"url":"https://api.github.com/repos/aspnet/Security/issues/207","labels_url":"https://api.github.com/repos/aspnet/Security/issues/207/labels{/name}","comments_url":"https://api.github.com/repos/aspnet/Security/issues/207/comments","events_url":"https://api.github.com/repos/aspnet/Security/issues/207/events","html_url":"https://github.com/aspnet/Security/issues/207","id":65806681,"number":207,"title":"OAuthBearerAuthenticationHandler does not call SecurityTokenValidated","user":{"login":"mdekrey","id":144461,"avatar_url":"https://avatars.githubusercontent.com/u/144461?v=3","gravatar_id":"","url":"https://api.github.com/users/mdekrey","html_url":"https://github.com/mdekrey","followers_url":"https://api.github.com/users/mdekrey/followers","following_url":"https://api.github.com/users/mdekrey/following{/other_user}","gists_url":"https://api.github.com/users/mdekrey/gists{/gist_id}","starred_url":"https://api.github.com/users/mdekrey/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/mdekrey/subscriptions","organizations_url":"https://api.github.com/users/mdekrey/orgs","repos_url":"https://api.github.com/users/mdekrey/repos","events_url":"https://api.github.com/users/mdekrey/events{/privacy}","received_events_url":"https://api.github.com/users/mdekrey/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-04-02T00:35:39Z","updated_at":"2015-04-02T00:35:39Z","closed_at":null,"body":"It looks like `OAuthBearerAuthenticationHandler` doesn't call the `SecurityTokenValidated` handler in the `Options.Notifications`.\r\n\r\nIn addition, logic goes on to use `securityTokenReceivedNotification` - `securityTokenValidatedNotification` is not checked after being instantiated, but is used once, hiding it from any Treat Warnings as Errors flags.\r\n\r\nStarting with line 133:\r\n\r\n```csharp\r\nvar securityTokenValidatedNotification = new SecurityTokenValidatedNotification<HttpContext, OAuthBearerAuthenticationOptions>(Context, Options)\r\n{\r\n    ProtocolMessage = Context,\r\n    AuthenticationTicket = ticket\r\n};\r\n\r\n// The following line is missing from source\r\nawait Options.Notifications.SecurityTokenValidated(securityTokenValidatedNotification);\r\nif (securityTokenReceivedNotification.HandledResponse)\r\n{\r\n    return securityTokenValidatedNotification.AuthenticationTicket;\r\n}\r\n```"}}