Migrate IJwtTokenReader and implementation from Arcus.WebApi to Arcus.Security

[fgheysels]

As far as I know, there's no direct alternative for the IJwtTokenReader and its implementation available in .NET itself (without having to do all the plumbing yourselves).

Might be an idea to migrate that functionality from Arcus.WebApi towards Arcus.Security since Arcus.WebApi is being archived ?

[stijnmoreels]

Moving to this repo would not something that feels right, as the Arcus.Security is more about general security principles than specific hosting, no?
Was never really a fan of how the IJwtTokenReader was created/implemented, maybe we could focus on the token validation instead of providing already an API filter for it, so it can be used independent from hosting technology?

[fgheysels]

JwtTokenReader as it exists in Arcus.WebApi is focussing on token-validation and is not bound to any (hosting) technology, isn't it ?
I'm not talking about the JwtTokenAuthorizationFilter nor about the BypassJwtTokenAuthorizationAttribute :)