title: Validate Google Id Token
body: <p>I'm using ASP.NET Core to serve an API to an Android client.  Android signs in as a Google account and passes a JWT, the ID Token, to API as a bearer token.  I have the app working, it does pass the auth checks, but I don't think it's validating the token signature.  </p>
  
  <p>Per Google's documents, I can call this url to do it:  <a href="https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123" rel="noreferrer">https://www.googleapis.com/oauth2/v3/tokeninfo?id_token=XYZ123</a>, but I can't find the appropriate hooks on the server side to do it.  Also according to the Google docs, I can somehow use the Client Access APIs to do it without calling to the server every time.  </p>
  
  <p>My configuration code:</p>
  
  <pre><code>app.UseJwtBearerAuthentication( new JwtBearerOptions()
  {
  
      Authority = "https://accounts.google.com",
      Audience = "hiddenfromyou.apps.googleusercontent.com",
      TokenValidationParameters = new TokenValidationParameters()
      {
          ValidateAudience = true,
          ValidIssuer = "accounts.google.com"
      },
      RequireHttpsMetadata = false,
      AutomaticAuthenticate = true,
      AutomaticChallenge = false,
  });
  </code></pre>
  
  <p>How do I get the JWTBearer middleware to validate the signature?  I'm close to giving up on using the MS middleware and rolling my own.</p>