title: Verifying/validating a JWT token created in PHP in .NET
body: <p>I have a JWT token created using PHP that I need to then use in a .NET app (framework version 4.5.1). The token is generated in PHP using the following code (relies on <a href="https://github.com/lcobucci/jwt" rel="nofollow">https://github.com/lcobucci/jwt</a> library):</p>
  
  <pre><code>use Lcobucci\JWT\Builder;
  use Lcobucci\JWT\Signer\Hmac\Sha256;
  
  $tokenBuilder = new Builder();
  $tokenSigner  = new Sha256();
  
  $token = (string)$tokenBuilder
      -&gt;setIssuer('localhost:8081')
      -&gt;setAudience('myaudience')
      -&gt;setIssuedAt(time())
      -&gt;setExpiration(time() + 86400)
      -&gt;sign($tokenSigner, '710VWV0zby')
      -&gt;getToken();
  
  return $token;
  </code></pre>
  
  <p>I've been able to read the token fine in C#, but am struggling mightily to figure out how to validate and verify the token signature.</p>
  
  <pre><code>TokenValidationParameters validationParameters = new TokenValidationParameters
  {
      ValidateIssuer = true
  };
  
  var tokenHandler = new JwtSecurityTokenHandler();
  
  // THIS IS TO TEST IF TOKEN CAN BE READ
  /*var jwtToken = tokenHandler.ReadJwtToken(token);
  
  HttpContext.Current.Response.Write(jwtToken.Issuer);*/
  
  SecurityToken validatedToken = null;
  try
  {
      tokenHandler.ValidateToken(token, validationParameters, out validatedToken);
  }
  catch (Exception)
  {
      HttpContext.Current.Response.Write("Invalid! :(");
  }
  
  if (validatedToken != null) {
      HttpContext.Current.Response.Write("Valid! :)");
  }
  </code></pre>
  
  <p>Obviously, my code can't verify any signature, given that there's not even any mention of a SHA-256 key anywhere. I'm assuming I need to include that somehow in the TokenValidationParameters there's a property I need to set, and I'm guessing SigningToken would be the one, but I don't really know where to start to specify an HMAC SHA 256 key.</p>