How does token validation work under the hood when the JwtBearer middleware receives a request, and what checks does it perform?

The middleware extracts the token from the Authorization header, verifies its cryptographic signature against the configured signing key (symmetric secret or asymmetric public key, often fetched dynamically from the issuer's JWKS endpoint), and validates standard claims: expiration (exp, rejecting expired tokens), not-before (nbf), issuer (iss, must match ValidIssuer), and audience (aud, must match ValidAudience) -- failing any check results in a 401 Unauthorized response before the request ever reaches your endpoint code.

options.TokenValidationParameters = new TokenValidationParameters {
    ValidateIssuerSigningKey = true,
    IssuerSigningKey = signingKey,
    ValidateLifetime = true,      // checks exp/nbf
    ValidateIssuer = true,
    ValidIssuer = "https://auth.myapp.com",
    ValidateAudience = true,
    ValidAudience = "myapp-api",
    ClockSkew = TimeSpan.FromMinutes(2)  // tolerance for clock drift
};