title: Read Custom request Header in OWIN Authentication
body: <p>I am trying to provide extra/custom authentication to MS Bot-framework project using OWIN other than default authentication from MS using app id/pwd. Yes the Bot is in-fact an api i tagged Webapi too. I added OWIN startup class and provided middleware to perform OAUTH-2 implementation to validate JWT. </p>
  
  <p>As MS Bot directline calls have a default Bearer token to be passed as Authorization header key,i given custom provider to accept JWT from Bot state. Please note my bot is surfaced in a Web app which will generate a auth token which will be setted in Bot state against unique user id, so i am in need of this user id value to retrieve the token from Bot state. So the best possible way i can think of is to intercept all ajax calls from my Webchat Bot control to add a custom header as "x-user-id", which i will read from my owin middleware request header.</p>
  
  <p>But it was not succeeding as i am not getting the header value in OWIN, which i am passing in ajax calls. But when i checked in Chrome, this header is being sent. I am confused on what could be the issue.</p>
  
  <p><strong>Ajax Interceptor</strong></p>
  
  <pre><code>if (window.XMLHttpRequest &amp;&amp; !(window.ActiveXObject)) {
          (function (send) {               
              XMLHttpRequest.prototype.send = function (data) {
                  this.setRequestHeader('x-user-id', '123456789');
                  send.call(this, data);
              };
  
          })(XMLHttpRequest.prototype.send);
      }
  </code></pre>
  
  <p><strong>AppBuilder Configuration</strong></p>
  
  <pre><code>public void Configuration(IAppBuilder app)
      {
          var policy = new CorsPolicy()
          {
              AllowAnyHeader = true,
              AllowAnyMethod = true,
              AllowAnyOrigin = true,
              SupportsCredentials = true
          };
          policy.ExposedHeaders.Add("x-user-id");
          app.UseCors(new CorsOptions()
          {
              PolicyProvider = new CorsPolicyProvider
              {
                  PolicyResolver = context =&gt; Task.FromResult(policy)
              }
          });
          app.Map("/api", ctx =&gt;
          {
              ctx.UseEsoAccessTokenValidation(new EsoAccessTokenOptions
              {
                  AccessTokenKey = "AccessToken",
                  ChannelId = "webchat",
                  Scopes = new string[] { "read", "write" }
              });
  
              ctx.UseWebApi(WebApiConfig.Register());
          });
      }
  </code></pre>
  
  <p><strong>Code to Read Header:</strong></p>
  
  <pre><code>private static async Task&lt;string&gt; GetAccessToken(OAuthRequestTokenContext context, EsoAccessTokenOptions options)
          {
              string accesstoken = string.Empty;
              var request = context.Request;
              if (request.Headers.ContainsKey("x-user-id"))
              {
                  userid = request.Headers.Get("x-user-id");
              }
         }
  </code></pre>
  
  <p><strong>Chrome Network Screenshot</strong><a href="https://i.stack.imgur.com/niWUD.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/niWUD.png" alt="enter image description here"></a></p>
  
  <p>Please help me understand what i am doing wrong here?</p>