title: secure webapi with a valid JWT based on claims
body: <p><a href="https://stackoverflow.com/questions/42007131/openid-create-claim-based-authorization-attribute">Here</a> is how I've created an claim based authorization attribute. But I have some doubts about how this work. </p>
  
  <p>Given the code from my startup class:</p>
  
  <pre><code>public void Configuration(IAppBuilder app)
      {
          if (app == null)
          {
              throw new ArgumentNullException(nameof(app));
          }
  
          app.UseIdentityServerBearerTokenAuthentication(new IdentityServerBearerTokenAuthenticationOptions
          {
              Authority = ConfigurationManager.AppSettings["Authentication:Authority"],
              RequiredScopes = ConfigurationManager.AppSettings["Authentication:Scopes"].Split(' ').ToList(),
              PreserveAccessToken = true
          });
      }
  </code></pre>
  
  <p>I was expecting that if I have this attribute to my controller and I send an invalid token(invalid signature) the request will be automatically rejected as unauthorized, but the code from the attribute is executed.</p>
  
  <p>Shouldn't <code>OWIN</code> validate the token first?</p>
  
  <p>How to make sure that the token is valid (valid stricture, signature, not expired, etc) and only after validate the claims?</p>