Thread.CurrentPrincipal.Identity vs HttpContext.User.Identity [duplicate]

Question

Possible Duplicate:
difference between http.context.user and thread.currentprincipal and when to use them?

What's the difference between these two in an ASP.NET application?

I know the HttpContext.User.Identity is set when the user is authenticated through FormsAuthentication. But when is the Thread.CurrentPrincipal.Identity set?

Do they always hold the same value?

Does that still hold true for other layers of the application that do not have access to a HttpContext?

Bisulcate

Answer 1

HttpContext.User.Identity is the current logged in user in your web app.

Thread.CurrentPrincipal applies only when the <authentication mode = "windows"/>. Normally this is using with Windows based applications (Winforms,WPF..)

Falla

Thread.CurrentPrincipal still works with mode="forms"... – Bisulcate

@Nico : But it doesn't give you the currently login user. It will give you the windows user details instead. So, in this case Thread.CurrentPrincipal doesn't make much sense. – Falla

In Forms Authentication the Thread.CurrentPrincipal can become unsynched from the HttpContext.User.Identity. See this old blog from Hanselman. Also see this newer stackoverflow – Quanta

Answer 2

if you use the HttpContext.User.Identity equals the Thread.CurrentPrincipal

Pinkerton

Not true. If you spin off a thread in the background, HttpContext.User may change whilst the thread is running, depending on how you are running it. – Politic

HttpContext.Current.User will be the current logged in web-user. Thread.CurrentPrincipal will be the principal for whomever is running the worker process (Thread). In the case of a forms/wpf app it makes sense because the user you're running the application under is the one you're interested in. – Tsai