I've spent the past few days reading about ASP.NET/Web API/Katana/ASP.NETCore and so on. The terrain seems to be shifting every couple years, and MS is reinforcing that feeling. At this point, after all the reading I have done, I'm not sure what is current and what is not, except that I'm pretty sure that I'm not.

I'm using Web API in 4.7.2. From what I have seen and tried, that can use some ASP.NETCore, but not everything. There are plenty of packages that won't install on framework, and require Core 2.x or 3.x.

Meanwhile Katana seems current, while ASP.NET appears somewhat deprecated by MS, though still viable. Does that sound right?

Ultimately, I'm looking to consume JWT tokens in a FW 4.7.2 application. There appears to be an abundance of means, none of which appear all that well documented. It looks like an OWIN approach using Microsoft.Owin.Security.Jwt would be both reasonably current, and likely to be sustainable for a few years. It also looks like VB.NET might be in Core 3.x by this fall/winter, which....actually complicates the situation, as one alternative was always to move over to C# for this and just build it in Core. I'd prefer to stick with FW for these reasons:

1) The API is already written, tested, and deployed, so a re-write holds little appeal.
2) I think it might be a bit less of a black box, though not by much.

Basically, I've found a whole lot of dubious articles on consuming/validating JWT tokens, along with a few that are pretty good. I'd probably go with one that has reasonably good documentation, which is why I am currently favoring Katana. However, I thought I'd ask for suggestions here. The amount of weak documentation is impressive. Some folks could use an editor...including me, so I'm sympathetic to the situation, but still....

So, any suggestions?