title: OWIN Bearer Token Authentication
body: <p>I have some questions related to Bearer Token. In Owin you can protect a ticket <code>Protect(ticket)</code> like this:</p>
  
  <pre><code>ClaimsIdentity identity = new ClaimsIdentity(Startup.OAuthServerOptions.AuthenticationType);
  
  identity.AddClaim(new Claim(ClaimTypes.Name, user.UserName));
  
   Dictionary&lt;string, string&gt; properties = new Dictionary&lt;string, string&gt;();
   properties.Add("UserId", user.Id);
   properties.Add("UserName", user.UserName);
   properties.Add("Role", "user");
  
   AuthenticationProperties properties = new AuthenticationProperties(properties);
  
   AuthenticationTicket ticket = new AuthenticationTicket(identity, properties);
  
  
   DateTime currentUtc = DateTime.UtcNow;
  
   DateTime expireUtc = currentUtc.Add(TimeSpan.FromHours(24));
  
   ticket.Properties.IssuedUtc = currentUtc;
   ticket.Properties.ExpiresUtc = expireUtc;
  
  
   string token = OAuthAuthorizationServerOptions.AccessTokenFormat.Protect(ticket)
  </code></pre>
  
  <p>Now the token will be something like this:</p>
  
  <p><code>nqak-9R6U64Owsm_lqn_mJzKc_Djd8iVnIw0EX77v5x2rybhf4m_zg_UnrsoO5BxDZQl0HWrSvvd4efa4ChNSf5rAGhd13aOXZlvwOJOZ5v_9bhRCq8A7tqHyiM6DqVVOyYs3lh2SU-wU1m85HH2IcYDtdTY3ijaKZ_QnP1nsqO5LRnnEL4upbETPW9zqWIZzZBX7_Y2cXi2v0K7WnlRor3gFKIZlU9J-NfidRpWXqq5744NfWWHalYADGS7eUWyuxPJCj9ykHYzaXFksJEXBw</code></p>
  
  <p>My questions: </p>
  
  <ul>
  <li><p>How this token is generated/encrypted?</p></li>
  <li><p>Are there any chances that somebody can try to mess'up with the token and add some custom claims to it?</p></li>
  </ul>
  
  <p>Example:</p>
  
  <p>If you have the token string you can do this:</p>
  
  <pre><code>AuthenticationTicket ticket = OAuthAuthorizationServerOptions.AccessTokenFormat.Unprotect(token);
  </code></pre>
  
  <p>Now you can add custom claims to it. For example if there is a <code>role</code> claim with value <code>user</code> then you can modify that claim and add <code>admin</code> then re encode the ticket and you get a token that has admin role.</p>
  
  <p>I actually din some tests, encoded a token on a server and then try to modify it on another system but I couldn't <code>Unprotect</code> it. Therefore I am thinking maybe the ticket is encrypted/decrypted using the machine key on which was originally created. However if I try to <code>Unprotect</code> it from the same machine it works. I can decrypt it and modify it.</p>
  
  <p>Can somebody explain this process please?</p>