{"action":"created","issue":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1327","labels_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1327/labels{/name}","comments_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1327/comments","events_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1327/events","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1327","id":74283363,"number":1327,"title":"Combine bearer token with MVC5 cookies","user":{"login":"huysentruitw","id":4618744,"avatar_url":"https://avatars.githubusercontent.com/u/4618744?v=3","gravatar_id":"","url":"https://api.github.com/users/huysentruitw","html_url":"https://github.com/huysentruitw","followers_url":"https://api.github.com/users/huysentruitw/followers","following_url":"https://api.github.com/users/huysentruitw/following{/other_user}","gists_url":"https://api.github.com/users/huysentruitw/gists{/gist_id}","starred_url":"https://api.github.com/users/huysentruitw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huysentruitw/subscriptions","organizations_url":"https://api.github.com/users/huysentruitw/orgs","repos_url":"https://api.github.com/users/huysentruitw/repos","events_url":"https://api.github.com/users/huysentruitw/events{/privacy}","received_events_url":"https://api.github.com/users/huysentruitw/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":2,"created_at":"2015-05-08T08:29:50Z","updated_at":"2015-05-08T08:39:33Z","closed_at":null,"body":"Say, we have a project hosting MVC and WebApi, both using the IdentityServer as SSO. For MVC, we would use the OpenIdConnect authentication middleware, while for the WebApi we would use the IdentityServer Bearer Token Authentication.\r\n\r\nIn case of MVC, I'm still having problems with the fact that the id_token is converted into an application cookie and that the tokens are no longer used. Somehow, it should be possible that the MVC controller actions validate the bearer token from IdentityServer (using the IdentityServer Bearer Token Authentication middleware) instead of the application cookie.\r\n\r\nThe problem with this is that the MVC web pages would have to set the Bearer token in the Authorization header for each request. But what if we have middleware that puts the token in a cookie and for each incoming request, validated the cookie, extracts the token and injects it into the Authorization header which is then processed by the IdentityServer Bearer Token Authentication middleware.\r\n\r\nMight sound like a crazy idea but I wonder if this is possible and if any existing middleware can help me with this?\r\n"},"comment":{"url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/comments/100154011","html_url":"https://github.com/IdentityServer/IdentityServer3/issues/1327#issuecomment-100154011","issue_url":"https://api.github.com/repos/IdentityServer/IdentityServer3/issues/1327","id":100154011,"user":{"login":"huysentruitw","id":4618744,"avatar_url":"https://avatars.githubusercontent.com/u/4618744?v=3","gravatar_id":"","url":"https://api.github.com/users/huysentruitw","html_url":"https://github.com/huysentruitw","followers_url":"https://api.github.com/users/huysentruitw/followers","following_url":"https://api.github.com/users/huysentruitw/following{/other_user}","gists_url":"https://api.github.com/users/huysentruitw/gists{/gist_id}","starred_url":"https://api.github.com/users/huysentruitw/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/huysentruitw/subscriptions","organizations_url":"https://api.github.com/users/huysentruitw/orgs","repos_url":"https://api.github.com/users/huysentruitw/repos","events_url":"https://api.github.com/users/huysentruitw/events{/privacy}","received_events_url":"https://api.github.com/users/huysentruitw/received_events","type":"User","site_admin":false},"created_at":"2015-05-08T08:39:33Z","updated_at":"2015-05-08T08:39:33Z","body":"What I'm asking is a way to validate the access token at an MVC controller instead of the application cookie. I'm not totally happy with the fact that the id_token/access_token is only used once to issue the application cookie. I want to validate the tokens for each call (preferably by re-using the IdentityServerBearerTokenAuthentication middleware)."}}