title: Custom Lifetime Validation With AspNet.Security.OpenIdConnect.Server (ASP.NET vNext)
body: <p>I am using Visual Studio 2015 Enterprise Update 1 and ASP.NET vNext rc1-update1 to issue and consume JWT tokens as described <a href="https://stackoverflow.com/questions/33140360/getting-an-access-token-in-asp-net-5/33147208">here</a>.</p>
  
  <p>In our implementation we want to control token lifetime validation. </p>
  
  <p>We tried several approaches, all of which had undesirable side effects. For example in one attempt we took over the TokenValidationParameters.TokenValidationParameters.LifetimeValidator event in the <em>Configure</em> method:</p>
  
  <pre class="lang-cs prettyprint-override"><code>app.UseJwtBearerAuthentication
  (
      options =&gt; 
      {
          options.TokenValidationParameters = new TokenValidationParameters()
          {
              LifetimeValidator = (DateTime? notBefore, DateTime? expires, SecurityToken securityToken, TokenValidationParameters validationParameters) =&gt;
              {
                  // Pretend to do custom validation
                  return false;
              }
          };
      }
  );
  </code></pre>
  
  <p>That event causes validation to fail as we'd like but the client receives a 500 error whereas we would like to return a 400-series error and a small payload instead.</p>
  
  <p>In another attempt we tried various implementations of TokenValidationParameters.Events, such as inspecting claims in the ValidatedToken event but found we were unable to prevent the middleware from invoking the controller action short of throwing an exception which got us back to the 500 error problem.</p>
  
  <p>So my questions are:</p>
  
  <ul>
  <li><p>What what is the best practices for taking over lifetime validation with OIDC? </p></li>
  <li><p>Can we force OIDC not to include certain lifetime claims in the token like "nbf" since we won't need them anyway?</p></li>
  </ul>