protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
{
 // ...
 var tokenAudience = ticket.Principal.Claims.Single(c => c.Type == "Aud");
 if (tokenAudience.Value != oAuthConfig.Value.Audience)
 {
 Context.Items[nameof(HttpStatusCode)] = (int)HttpStatusCode.Forbidden;
 return AuthenticateResult.Fail("Incorrect audience");
 }
 return AuthenticateResult.Success(ticket);
}
protected override async Task HandleChallengeAsync(AuthenticationProperties properties)
{
 if (!Context.Items.TryGetValue(nameof(HttpStatusCode), out object? statusCode))
 {
 return base.HandleChallengeAsync(properties);
 }
 Response.StatusCode = (int)statusCode!;
 return Task.CompleteTask;
}

protected override async Task<AuthenticateResult> HandleAuthenticateAsync()
{
 // ...
 return AuthenticateResult.Fail(failureMessage, new AuthenticationProperties
 {
 { nameof(HttpStatusCode), HttpStatusCode.Forbidden }
 });
}
protected override async Task HandleChallengeAsync(AuthenticationProperties properties) {} // properties are empty