ValidateTokenAttribute.cs

    public class ValidateTokenAttribute : TypeFilterAttribute
    {
        public ValidateTokenAttribute() : base(typeof(ValidateTokenFilterImpl))
        {
        }

        public class ValidateTokenFilterImpl : IAsyncActionFilter
        {
            public async Task OnActionExecutionAsync(ActionExecutingContext context, ActionExecutionDelegate next)
            {
                if (context.ActionArguments.ContainsKey("userId"))
                {
                    var userId = context.ActionArguments["userId"] as string;
                    var userIdFromToken = context.HttpContext.User.Identity.Name;
                    if (!userId.Equals(userIdFromToken))
                    {
                        context.Result = new UnauthorizedResult();
                        return;
                    }
                }
                await next();
            }
        }
    }