c# - OWIN Bearer Token Authentication -

i have questions related bearer token. in owin can protect ticket protect(ticket) this:

claimsidentity identity = new claimsidentity(startup.oauthserveroptions.authenticationtype);  identity.addclaim(new claim(claimtypes.name, user.username));   dictionary<string, string> properties = new dictionary<string, string>();  properties.add("userid", user.id);  properties.add("username", user.username);  properties.add("role", "user");   authenticationproperties properties = new authenticationproperties(properties);   authenticationticket ticket = new authenticationticket(identity, properties);    datetime currentutc = datetime.utcnow;   datetime expireutc = currentutc.add(timespan.fromhours(24));   ticket.properties.issuedutc = currentutc;  ticket.properties.expiresutc = expireutc;    string token = oauthauthorizationserveroptions.accesstokenformat.protect(ticket) 

now token this:

nqak-9r6u64owsm_lqn_mjzkc_djd8ivniw0ex77v5x2rybhf4m_zg_unrsoo5bxdzql0hwrsvvd4efa4chnsf5raghd13aoxzlvwojoz5v_9bhrcq8a7tqhyim6dqvvoyys3lh2su-wu1m85hh2icydtdty3ijakz_qnp1nsqo5lrnnel4upbetpw9zqwizzzbx7_y2cxi2v0k7wnlror3gfkizlu9j-nfidrpwxqq5744nfwwhalyadgs7euwyuxpjcj9ykhyzaxfksjexbw

my questions:

• how token generated/encrypted?

• are there chances can try mess'up token , add custom claims it?

example:

if have token string can this:

authenticationticket ticket = oauthauthorizationserveroptions.accesstokenformat.unprotect(token); 

now can add custom claims it. example if there role claim value user can modify claim , add admin re encode ticket , token has admin role.

i din tests, encoded token on server , try modify on system couldn't unprotect it. therefore thinking maybe ticket encrypted/decrypted using machine key on created. if try unprotect same machine works. can decrypt , modify it.

can explain process please?

how token generated/encrypted?

the data protection provider can set using setdataprotectionprovider extension method on iappbuilder object. when not done, data protection provider of host used. in case of iis + asp.net, machinekeydataprotector in assembly microsoft.owin.host.systemweb. self-hosting, dpapi. basically, token encrypted , maced , protect() about.

are there chances can try mess'up token , add custom > claims it?

no. not possible. token protected in machine cannot unprotected somewhere else. exception case of web farm have multiple machines. 1 machine can protect , if subsequent request goes other machine, machine should have ability unprotect. dpapi, not possible. machinekeydataprotector, possible having same machinekey section in machines. if concerned mitm being able this, no, not possible.