asp.net core w/ cookie middleware - accessing request data on authorization

As you said it is possible to access request's data on OnValidatePrincipal event. So, you can write something like this:

OnValidatePrincipal = async (context) =>
{
      if (context.Request.Path.Value.StartsWith("/teams/")) 
      {
          var teamId = // get team id from Path;

          if (user is not team member)
          {
              context.Response.StatusCode = 403;
          }
      }
} 

However, i think your requirement is related Authorization rather than Authentication. I would use Policy-Based Authorization to handle the requirement. Example policy should be like this:

Requirement and Handler:

public class TeamMemberHandler: AuthorizationHandler<TeamMemberRequirement>
{
    private readonly IActionContextAccessor _accessor; // for getting teamId from RouteData
    public TeamMemberHandler(IActionContextAccessor accessor)
    {
        _accessor = accessor;
    }
    protected override Task HandleRequirementAsync(AuthorizationHandlerContext context, TeamMemberRequirement requirement)
    {
        var teamId = // get teamId with using _accessor
        if (user is not member of team(by teamId))
        {
            context.Fail();
        }
        return Task.FromResult(0);
    }
}
public class TeamMemberRequirement : IAuthorizationRequirement
{
}

Configure Services:

public void ConfigureServices(IServiceCollection services)
{
    services.AddMvc();
    services.AddSingleton<IActionContextAccessor, ActionContextAccessor>();
    services.AddAuthorization(options =>
    {
        options.AddPolicy("TeamMember",
                          policy => policy.Requirements.Add(new TeamMemberRequirement()));
    });

    services.AddSingleton<IAuthorizationHandler, TeamMemberHandler>();
}

Finally use it on top of controller(or if you want, you can add filter globally)

Authorize[(Policy = "TeamMember")]
public class TeamHomeController : Controller
{
    // Authorize[(Policy = "AnotherPolicy")]
    public IActionResult Index(){}
}