How can I validate a custom token (which is not JWT) in ASP .NET Core 2.0 Web API?

In ASP .NET Core 2.0 you can write you own Middleware to validate token. You can see this video as exapmle - https://www.youtube.com/watch?v=n0llyujNGw8.

Summarily: 1. Create TokenMiddleware:

public class TokenMiddleware
{
    // always should be RequestDelegate in constructor
    private readonly RequestDelegate _next;
    public TokenMiddleware(RequestDelegate next)
    {
        _next = next;
    }

    // always should be defiened Invoke or InvokeAsync with HttpContext and returned Task (You can also inject you services here - for example DataContext)
    public async Task InvokeAsync(HttpContext context, DataContext dataContext)
    {
        var validKey = true;

        // than you logic to validate token              

        if (!validKey)
        {
            context.Response.StatusCode = (int) HttpStatusCode.Forbidden;
            await context.Response.WriteAsync("Invalid Token");
        }
        // if validm than next middleware Invoke
        else
        {
            await _next.Invoke(context);
        }
    }
}

// Extension to IApplicationBuilder (to register you Middleware)
public static class TokenExtensions
{
    public static IApplicationBuilder UseTokenAuth(this IApplicationBuilder builder)
    {
        return builder.UseMiddleware<TokenMiddleware>();
    }
}

2. Registred you Middleware in Startup:

app.UseTokenAuth();

Question was made long time ago, but for people that might stumble upon it, here is the way I did it, taking advantage of authentication and authorization middlewares. The question doesn't have details about the way the token is passed in the request but I am assuming a standard Authorization header.

Create a custom AuthenticationHandler

MyCustomTokenHandler.cs

public class MyCustomTokenHandler: AuthenticationHandler<AuthenticationSchemeOptions>
{
    public MyCustomTokenHandler(IOptionsMonitor<AuthenticationSchemeOptions> options, ILoggerFactory logger, UrlEncoder encoder, ISystemClock clock) : base(options, logger, encoder, clock)
    {
    }

    protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
    {
        if (!Request.Headers.ContainsKey("Authorization"))
        {
            return AuthenticateResult.NoResult();
        }
        if (!AuthenticationHeaderValue.TryParse(Request.Headers["Authorization"], out AuthenticationHeaderValue? headerValue))
        {
            return AuthenticateResult.NoResult();
        }
        if (!Scheme.Name.Equals(headerValue.Scheme, StringComparison.OrdinalIgnoreCase))
        {
            return AuthenticateResult.NoResult();
        }
        if (headerValue.Parameter == null)
        {
            return AuthenticateResult.NoResult();
        }
        //The token value is in headerValue.Parameter, call your db to verify it and get the user's data

        var claims = new[] { new Claim(ClaimTypes.Name, "username found in db") };
        //set more claims if you want
        var identity = new ClaimsIdentity(claims, Scheme.Name);
        var principal = new ClaimsPrincipal(identity);
        var ticket = new AuthenticationTicket(principal, Scheme.Name);
        return AuthenticateResult.Success(ticket);
    }
}

Register the handler and enable authorization

Program.cs

builder.Services.AddAuthentication("Bearer").AddScheme<AuthenticationSchemeOptions, MyCustomTokenHandler>("Bearer", null);
//...
var app = builder. Build();
app.UseAuthentication();
app.UseAuthorization();

Most of the code is inspired by this blog post: https://joonasw.net/view/creating-auth-scheme-in-aspnet-core-2