liveservices/LiveSDK — Issue #4: JsonWebToken sample is not working correctly
Author: gilad61
Created: 2012-01-05 08:39:28+00:00
State: open

In "LiveSDK/Samples/Asp.net/AuthenticationTokenSample/JsonWebToken.cs" there are two mistakes that make the signature validation fail:
1. In line 284 - the HMACSHA256 should be created using the 'signingKey' variable and not 'bytes'.
2. In line 260 - the comment says to use key + "JWTSIG", but the code only uses 'key'. In fact none of these work, and only when changed to key + "JWTSig" (with lowercase 'ig') the validation passes.

I am not sure what is the standard way to create the signing key, but it looks like the Live Connect service uses key + "JWTSig" to sign the token.
I also found a version of this validation code that does use "JWTSig" on MSDN forum - http://social.msdn.microsoft.com/Forums/en-US/messengerconnect/thread/0705264a-e306-4cfd-a007-017fd60b1f6a