Validate Google Id Token
<p>I'm using ASP.NET Core to serve an API to an Android client.  Android signs in as a Google account and passes a JWT, the ID Token, to API as a bearer token.  I have the app working, it does pass the auth checks, but I don't think it's validating the token signature.  </p>

<p>Per Google's documents, I can call this url to do it:  <a href="https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123" rel="noreferrer">https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123</a>, but I can't find the appropriate hooks on the server side to do it.  Also according to the Google docs, I can somehow use the Client Access APIs to do it without calling to the server every time.  </p>

<p>My configuration code:</p>

<pre><code>app.UseJwtBearerAuthentication( new JwtBearerOptions()
{

    Authority = "https://accounts.google.com",
    Audience = "hiddenfromyou.apps.googleusercontent.com",
    TokenValidationParameters = new TokenValidationParameters()
    {
        ValidateAudience = true,
        ValidIssuer = "accounts.google.com"
    },
    RequireHttpsMetadata = false,
    AutomaticAuthenticate = true,
    AutomaticChallenge = false,
});
</code></pre>

<p>How do I get the JWTBearer middleware to validate the signature?  I'm close to giving up on using the MS middleware and rolling my own.</p>