Verifying/validating a JWT token created in PHP in .NET
<p>I have a JWT token created using PHP that I need to then use in a .NET app (framework version 4.5.1). The token is generated in PHP using the following code (relies on <a href="https://github.com/lcobucci/jwt" rel="nofollow">https://github.com/lcobucci/jwt</a> library):</p>

<pre><code>use Lcobucci\JWT\Builder;
use Lcobucci\JWT\Signer\Hmac\Sha256;

$tokenBuilder = new Builder();
$tokenSigner  = new Sha256();

$token = (string)$tokenBuilder
    -&gt;setIssuer('localhost:8081')
    -&gt;setAudience('myaudience')
    -&gt;setIssuedAt(time())
    -&gt;setExpiration(time() + 86400)
    -&gt;sign($tokenSigner, '710VWV0zby')
    -&gt;getToken();

return $token;
</code></pre>

<p>I've been able to read the token fine in C#, but am struggling mightily to figure out how to validate and verify the token signature.</p>

<pre><code>TokenValidationParameters validationParameters = new TokenValidationParameters
{
    ValidateIssuer = true
};

var tokenHandler = new JwtSecurityTokenHandler();

// THIS IS TO TEST IF TOKEN CAN BE READ
/*var jwtToken = tokenHandler.ReadJwtToken(token);

HttpContext.Current.Response.Write(jwtToken.Issuer);*/

SecurityToken validatedToken = null;
try
{
    tokenHandler.ValidateToken(token, validationParameters, out validatedToken);
}
catch (Exception)
{
    HttpContext.Current.Response.Write("Invalid! :(");
}

if (validatedToken != null) {
    HttpContext.Current.Response.Write("Valid! :)");
}
</code></pre>

<p>Obviously, my code can't verify any signature, given that there's not even any mention of a SHA-256 key anywhere. I'm assuming I need to include that somehow in the TokenValidationParameters there's a property I need to set, and I'm guessing SigningToken would be the one, but I don't really know where to start to specify an HMAC SHA 256 key.</p>