Adding token property to MessageReceivedNotification

src/Microsoft.AspNet.Security.OAuthBearer/OAuthBearerAuthenticationHandler.cs

@@ -59,10 +59,15 @@ namespace Microsoft.AspNet.Security.OAuthBearer
                     return null;
                 }
 
+                // If application retrieved token from somewhere else, use that.
+                token = messageReceivedNotification.Token;
+
+                if (string.IsNullOrEmpty(token))
+                {
                     string authorization = Request.Headers.Get("Authorization");
 
                     // If no authorization header found, nothing to process further
-                if (String.IsNullOrEmpty(authorization))
+                    if (string.IsNullOrEmpty(authorization))
                     {
                         return null;
                     }
@@ -77,6 +82,7 @@ namespace Microsoft.AspNet.Security.OAuthBearer
                     {
                         return null;
                     }
+                }
 
                 // notify user token was received
                 var securityTokenReceivedNotification =

src/Microsoft.AspNet.Security/Notifications/MessageReceivedNotification.cs

@@ -12,5 +12,10 @@ namespace Microsoft.AspNet.Security.Notifications
         }
 
         public TMessage ProtocolMessage { get; set; }
+
+        /// <summary>
+        /// Bearer Token. This will give application an opportunity to retrieve token from an alternation location.
+        /// </summary>
+        public string Token { get; set; }
     }
 }

test/Microsoft.AspNet.Security.Test/OAuthBearer/OAuthBearerMiddlewareTests.cs

@@ -137,6 +137,23 @@ namespace Microsoft.AspNet.Security.OAuthBearer
             return Task.FromResult<object>(null);
         }
 
+        [Fact]
+        public async Task RetrievingTokenFromAlternateLocation()
+        {
+            var server = CreateServer(options => {
+                options.Notifications.MessageReceived = MessageReceived;
+                options.Notifications.SecurityTokenReceived = SecurityTokenReceived;
+            });
+            var response = await SendAsync(server, "http://example.com/oauth", "Bearer Token");
+            response.Response.StatusCode.ShouldBe(HttpStatusCode.OK);
+        }
+
+        private static Task MessageReceived(MessageReceivedNotification<HttpContext, OAuthBearerAuthenticationOptions> notification)
+        {
+            notification.Token = "CustomToken";
+            return Task.FromResult<object>(null);
+        }
+
         class BlobTokenValidator : ISecurityTokenValidator
         {