Verify token from query string

[jjchiw]

Hi

I had a problem with the authentication in SignalR sending the Token via headers, it seems it can't be done right now in js, because the websockets does not support headers, so all the solutions that I found were to send the token in the Query String.

So I added to look for the Authorization keyword in the query string and validate that value with the ITokenValidator.

I added a UrlEncodingParser from https://github.com/RickStrahl/WestwindToolkit/blob/master/Westwind.Utilities/SupportClasses/UrlEncodingParser.cs in order to parse the query string

[jchannon]

I use this for SIgnalR https://github.com/VQComms/Owin.QueryStringToHeader

Not sure if that helps or hinders

[jjchiw]

Hi

Well Owin.QueryStringToHeader it's another way to do it, It doesn't hard code the Authorization query parameter name and you can set the parameters that would like to pass to the requestHeader, with the name that you want and it helps as a workaround to authenticate SignalR websockets.

If it's used as a "Combo" Owin.StatelessAuth + Owin.QueryStringToHeader make this PR useless. :)

I think this line should be changed to escape singlePair[1] like this Uri.UnescapeDataString(val); line

I also had a problem, I was sending the Authorization in the query string like this
Authorization=Token [token] and in the query string was sent with + Authorization=Token+[token] encoded as a query string. That's why I added the property DecodeSpacesAsPlusSigns to StatelessAuthOptions in order to {treat the plus sign as space](https://github.com/jjchiw/Owin.StatelessAuth/blob/master/src/Owin.StatelessAuth/UrlEncodingParser.cs#L36)

In summary, I think that this PR is useless if somebody use the "Combo" (Owin.StatelessAuth + Owin.QueryStringToHeader) and Owin.QueryStringToHeader escape singlePair[1]

:)